Content-Security-Policy
Most shops have no Content-Security-Policy (CSP) and need nothing here. If your shop sends one, add these three entries to it. Keep everything else in your policy as it is.
script-src https://sdk.fitmytype.com;
frame-src https://plugin.fitmytype.com;
connect-src https://api.fitmytype.com;| Directive | Add | Why |
|---|---|---|
script-src | https://sdk.fitmytype.com | loads sdk.js and its small lazy files (the tooltip) |
frame-src | https://plugin.fitmytype.com | shows the size finder in its own frame |
connect-src | https://api.fitmytype.com | checks the product and sends the widget's events |
Styles and nonces
The button adds one small <style> tag. If your style-src has no
'unsafe-inline', give the sdk.js script tag your page's nonce
(<script nonce="…" src="…/sdk.js">): the style tag takes the same nonce. FitMyType adds no
inline scripts.
What we do on our side
The size finder only opens on the shop domains you listed in the back-office: our frame refuses to be shown anywhere else, and it cannot navigate or change your page. If your policy blocks the frame, the button still shows and your page keeps working; the size finder just does not open.