Two different blockers look alike: server CSP headers and browser extensions. Split them — test once with extensions off and once with headers relaxed in staging.
Server CSP
- Open DevTools Console on the live page with the widget missing
- Look for Content-Security-Policy violations naming getamevia.com
- Add the script host from Installation to script-src
- Add connect-src entries if network calls to Amevia fail CSP
- Deploy header changes and hard-refresh
Browser blockers
- Retry in a private window with extensions disabled
- If the widget appears, educate testers or document allowed domains for corporate browsers
- Do not treat ad-block-only success as production-ready for all visitors
Debugging order
- Confirm the script exists in View Source before chasing CSP
- Report-only CSP modes log but do not block — read reports then enforce carefully
- See Content Security Policy blocking the widget for widget-specific allowlists