# Iframe issue without URL

**URL:** https://meta.discourse.org/t/iframe-issue-without-url/115512
**Category:** Support
**Created:** [April 20, 2019, 2:01am UTC](https://meta.discourse.org/t/iframe-issue-without-url/115512 "2019-04-20T02:01:45Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [April 20, 2019, 12:54pm UTC](https://meta.discourse.org/t/iframe-issue-without-url/115512/4 "2019-04-20T12:54:35Z")

</div>

> [@waffleslop](#):
>
> What am I missing?

Since the script you’re adding

```plaintext
<script src="https://cmox.cdn.vooplayer.com/assets/vooplayer.js"></script>

```

is considered third-party, you would need to whitelist it. You can do that by adding

```plaintext
https://cmox.cdn.vooplayer.com/assets/vooplayer.js

```

to the `content_security_policy_script_src` site setting in the admin like so

 ![whitelist](https://global.discourse-cdn.com/meta/original/3X/6/6/660c1ef8a5b5fea01604cb49bf7ce535553473e9.png)

If you’d like to learn more about Content Security Policy and how it affects Discourse customizations, please have a look [here](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)

Also note that the `src` attribute in your Iframe code is empty so it doesn’t really load anything. Make sure the `src` attribute is set to the `src` of the Iframe you’re trying to load.

---

_[View the full topic](https://meta.discourse.org/t/iframe-issue-without-url/115512)._