Allowed domains
The chat widget only loads on pages whose domain is in the site’s allowed domains. This stops anyone from copying your snippet onto another website and using your quota.
- Add every domain visitors use: the main domain,
www, a shop subdomain, a separate checkout domain. - To test locally, add
localhost; remove it later if you like. - If a page’s domain isn’t on the list, the bubble simply doesn’t appear there.
Content Security Policy (CSP)
If your site sends a Content-Security-Policy header, allow AskCub’s resources or the widget will be blocked. You need to allow:
| Directive | Allow |
|---|---|
script-src | https://static.pathclue.com and https://chat.askcub.com |
connect-src | https://api.pathclue.com (page views and chat status) and the chat connection wss://ws.askcub.com |
frame-src | https://chat.askcub.com (the chat window runs in a frame) |
img-src | https://file.pathclue.com for avatars, logos and image messages |
After changing the policy, reload your site and check the browser console for “Refused to load” messages.
Other protections
- Rate limits slow down bursts of messages and new conversations automatically.
- Spam links and words you block are filtered.
- You can ban a visitor for up to 30 days.
- IP addresses are used in memory for rate limiting and aren’t stored with conversations.