> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usefrictionless.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Allowed websites and CSP

> Stop other websites from showing your chat, and what to allow in a Content Security Policy.

## Allowed websites

Your Workspace ID is public, so by default any website can show your chat. To stop that, add your websites in **Integrations → Website chat → Install**.

* A website also covers its subdomains, so `example.com` allows `shop.example.com`.
* Your chat link and `localhost` always work, so you can keep testing.
* On any other website the chat doesn't appear, and the browser console explains why.
* Bookings follow the same list. Anywhere else, our booking form says it isn't set up for that website.

<Note>
  This stops other websites from embedding your chat. It isn't a login, so keep private data out of `track()`.
</Note>

## Content Security Policy

If your site sets a Content Security Policy, allow:

```text theme={null}
script-src  usefrictionless.com
connect-src api.usefrictionless.com wss://api.usefrictionless.com
img-src     api.usefrictionless.com blob: https:
media-src   api.usefrictionless.com blob:
style-src   'unsafe-inline'
```

* `img-src https:` covers pictures in your News posts, which can come from any address.
* `style-src 'unsafe-inline'` is needed because the chat's styles live inside its own Shadow DOM, where your site's CSS can't reach them.

The booking form on its own needs less:

```text theme={null}
script-src  usefrictionless.com
connect-src api.usefrictionless.com
style-src   'unsafe-inline'
```

The chat and the booking form can sit on the same page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.