Allowed sites & troubleshooting
A booking widget only appears on websites that Gurita allows to frame it. This page explains where that allow-list comes from and how to fix an embed the browser refuses to show.
How framing is controlled
When a browser loads https://YOUR-DOMAIN/widget/<slug>, Gurita answers with a Content-Security-Policy header whose frame-ancestors list names the sites allowed to show the widget in an iframe. The browser enforces it: on any other site the iframe stays blank.
The list is made up of:
| Source | What it adds | How it gets there |
|---|---|---|
| Gurita's own domains | https://*.gurita.app, https://*.doridina.de and your Gurita address | Always included. |
| Paired WordPress sites | The address of every WordPress site connected through the Gurita Booking plugin | Automatically, when the plugin is connected. See Gurita for WordPress. |
| Your system's allow-list | Domains set for your whole Gurita system | Set by Gurita when your system is hosted. |
| The widget's own allow-list | Domains allowed for this widget only | Stored with the widget. |
Important: There is no field in the widget form for the allow-list yet. To embed a widget on a website that isn't a paired WordPress site, contact us with the exact address of your site and we'll add it.
Which address to send
Send the address exactly as it appears in the browser's address bar, scheme included:
https://www.example.com— only that host.https://*.example.com— every subdomain ofexample.com. This does not coverhttps://example.comitself; send both if you need both.
www.example.com and example.com are different sites to the browser. So are http:// and https://.
Troubleshooting a blocked embed
Open your page, then the browser's developer tools (F12, or right-click → Inspect), and look at the Console.
"Refused to frame … because an ancestor violates the following Content Security Policy directive: frame-ancestors …" Your site isn't on the allow-list. The message shows the list the browser checked. Compare it with your site's exact address — watch for www. and http vs https.
"Refused to frame 'https://YOUR-DOMAIN/' because it violates … frame-src" (or "child-src") Your own website's Content Security Policy blocks iframes from Gurita. Add your Gurita address to your site's policy:
Content-Security-Policy: frame-src https://YOUR-DOMAINThe iframe shows your Gurita home page instead of the widget The widget is Inactive or the slug is wrong. Check both in Master Data → Booking Widgets.
The widget shows but has a scrollbar or is cut off The resizer script didn't run. Make sure you pasted the whole snippet, including both <script> blocks, and that your site doesn't block cdn.jsdelivr.net. See Embed the widget.
Local development
To try the widget while you build your site, open it directly at https://YOUR-DOMAIN/widget/<slug>. To test the embed itself, use a staging address that is on the allow-list.