Troubleshooting The Chat Embed (Including CSP)
If you've added the snippet from Dashboard → Chat → Embed but the chat launcher isn't showing on your website, work through the checks below. Most issues are one of: the tag hasn't published, chat isn't enabled, or your site's Content Security Policy is blocking it.
Quick checklist
- Is chat enabled? In Dashboard → Chat, make sure chat is set up and turned on for this showroom.
- Did the tag publish? In Google Tag Manager, confirm the Custom HTML tag is live (you clicked Submit), fires on All Pages, and isn't paused.
- Right showroom + host? The snippet's
data-vyro-showroomanddata-vyro-hostshould match exactly what Dashboard shows — don't edit them. - One snippet only. Make sure it isn't added twice (e.g. in both GTM and the page HTML). The loader ignores duplicates, but two different showroom codes will conflict.
- Ad blockers. Some aggressive blockers hide chat widgets. Test in a private window with extensions disabled.
- Give it a minute. GTM changes and CDN caching can take a minute or two.
If it still doesn't appear, it's almost always CSP — read on.
Content Security Policy (CSP) blocks
If your website sends a Content Security Policy, the browser will refuse to load anything the policy doesn't explicitly allow — including our loader script and the chat iframe. This is the most common cause of "nothing appears" on security-hardened sites.
How to tell
Open the browser's developer tools (F12 or right-click → Inspect) and look at the Console tab. A CSP block shows a red error like:
Refused to load the script 'https://embed.vyro.com.au/chat.js' because it violates the following Content Security Policy directive: "script-src ...".
or
Refused to frame 'https://…' because it violates the following Content Security Policy directive: "frame-src ...".
What to allow
Add our origins to your CSP. You only need two directives (the loader is a script that adds an iframe; it makes no other requests from your page):
| Directive | Add | Why |
|---|---|---|
script-src |
the loader origin, e.g. https://embed.vyro.com.au |
to load chat.js |
frame-src (or child-src on older policies) |
the host from your snippet's data-vyro-host |
to show the chat iframe |
Example — if your current policy is:
Content-Security-Policy: default-src 'self'; script-src 'self';
extend it to:
Content-Security-Policy: default-src 'self';
script-src 'self' https://embed.vyro.com.au;
frame-src https://<your-data-vyro-host>;
Use the exact data-vyro-host value from Dashboard → Chat → Embed for
frame-src. If you set CSP via a <meta http-equiv="Content-Security-Policy">
tag instead of a header, add the same sources there.
The chat's own network calls (inventory, messages) happen inside the Vyro iframe, which is served from our host — so they're governed by our CSP, not yours. You don't need to allow
connect-srcfor chat-api on your site.
If you use Google Tag Manager
GTM injects the tag into your page, so your page's CSP still applies. If you use
a nonce-based CSP, GTM Custom HTML tags may be blocked — allow the GTM domains
per Google's CSP guidance, or add the snippet directly to your HTML instead.
Still stuck?
Grab the exact red error text from the browser Console and send it to your Vyro contact — the directive name in the message tells us precisely what to allow.