# JS script is not loading

**URL:** https://meta.discourse.org/t/js-script-is-not-loading/146306
**Category:** Support
**Created:** [March 31, 2020, 4:13pm UTC](https://meta.discourse.org/t/js-script-is-not-loading/146306 "2020-03-31T16:13:57Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![pixelemotion](https://avatars.discourse-cdn.com/v4/letter/p/4af34b/32.png) [@pixelemotion](https://meta.discourse.org/u/pixelemotion)
#### Post date: [March 31, 2020, 4:13pm UTC](https://meta.discourse.org/t/js-script-is-not-loading/146306/1 "2020-03-31T16:13:57Z")

</div>

Hello everyone,

I’m trying to embed the the optinmonster JS script in order to show a welcome pop-up for the launch of the forum.

I used the HTML Theme component to insert it right before the

But I get this error in the browser console :

`Refused to load the script 'https://a.omappapi.com/app/js/api.min.js' because it violates the following Content Security Policy directive: "script-src 'report-sample' .... Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. `  
Is there something I should allow in the settings to load the script ?

Thanks for the help

---

<div class="post-metadata">

### Author: ![zcuric](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zcuric/32/292837_2.png) [@zcuric](https://meta.discourse.org/u/zcuric)
#### Post date: [March 31, 2020, 4:32pm UTC](https://meta.discourse.org/t/js-script-is-not-loading/146306/2 "2020-03-31T16:32:11Z")

</div>

You can find solution to your problem here:

> [@Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243):
>
> bookmark This guide explains how to use Content Security Policy (CSP) to mitigate Cross-Site Scripting (XSS) attacks in Discourse. It covers CSP basics, configuration, and best practices. person_raising_hand Required user level: Administrator Summary Content Security Policy (CSP) is a crucial security feature in Discourse that helps protect against Cross-Site Scripting (XSS) and other injection attacks. This guide covers the basics of CSP, how it’s implemented in Discourse, and how to c…

---

<div class="post-metadata">

### Author: ![pixelemotion](https://avatars.discourse-cdn.com/v4/letter/p/4af34b/32.png) [@pixelemotion](https://meta.discourse.org/u/pixelemotion)
#### Post date: [March 31, 2020, 4:41pm UTC](https://meta.discourse.org/t/js-script-is-not-loading/146306/3 "2020-03-31T16:41:04Z")

</div>

Yep, exactly what I needed. Thanks !

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [April 30, 2020, 4:41pm UTC](https://meta.discourse.org/t/js-script-is-not-loading/146306/4 "2020-04-30T16:41:14Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.