> Add Content Security Policy directives so embeds, fonts and images from other domains load inside your LiveDemo.

Canonical: https://livedemo.ai/docs/edit-a-livedemo/content-security-policy/

# Content Security Policy

Demos block content from other domains for safety. If an [embed popup](https://livedemo.ai/docs/edit-a-livedemo/embed-popups/), font or image in an HTML screen doesn't load, allow its domain here.

## Add a directive

1. Open **Custom → Security** in the editor.
2. In **Additional Content Security Policy**, add the directives you need, separated by `;`.
3. Click **Save**. You'll see **Saved successfully**, or **Failed to save. Check CSP syntax.**

## Examples

| To allow | Add |
| --- | --- |
| Cal.com calendar | `frame-src https://app.cal.com; script-src https://app.cal.com` |
| Calendly | `frame-src https://calendly.com; script-src https://assets.calendly.com` |
| Typeform | `frame-src https://form.typeform.com` |
| YouTube | `frame-src https://www.youtube.com` |
| Google Fonts | `style-src https://fonts.googleapis.com; font-src https://fonts.gstatic.com` |
| Images from your CDN | `img-src https://cdn.yourcompany.com` |

## Find what's blocked

Open the demo, press `F12` and look in the **Console** for "Refused to load… because it violates the Content Security Policy". The message names the directive and domain to add.

This setting is about content *inside* the demo. If your own website blocks the demo, see [Troubleshooting](https://livedemo.ai/docs/resources/troubleshooting/#the-embedded-demo-is-blank-or-doesnt-load).