How to allow the status pill through a Content-Security-Policy
Two origins to allow, one line to paste. The pill needs nothing inline, and the App logs package needs one hostname.
If your site sends a Content-Security-Policy, the pill needs two origins allowed. Nothing else: it sets no cookies, opens no frames, and uses no inline styles or scripts.
What the pill talks to
- Your status page’s address serves the script, at
/embed/v1/badge.jsunder it. That is the address shown at the top of the Status pill page, for examplehttps://acme.uptimeagent.com. https://app.uptimeagent.comanswers with your current state. The pill asks it once a minute, without credentials.
Add the two origins
Open Status pills in the sidebar, choose your domain, then expand Using a Content-Security-Policy? at the foot of the page and copy the two lines shown there — the same two origins, filled in with your page’s address.
Merged into a policy header they look like this. Replace acme.uptimeagent.com with your status page’s address and keep whatever your policy already allows:
Content-Security-Policy: script-src 'self' https://acme.uptimeagent.com; connect-src 'self' https://app.uptimeagent.com
If you set your policy with a <meta http-equiv="Content-Security-Policy"> tag instead of a header, the same two directives apply.
Nothing is needed under style-src, img-src, frame-src or font-src. The pill styles itself through a constructed stylesheet rather than an inline <style>, draws its agent as inline SVG, and never opens a frame.
Check it worked
Reload your page with the browser console open. A pill that renders, and no Content-Security-Policy line in the console, means the policy allows it.
The pill deliberately renders nothing when it cannot load its script or reach us. A blank spot with a console error naming badge.js or app.uptimeagent.com means a directive is still missing.
If a firewall blocks our checks
This guide is about the pill on your site. The checks that decide whether you are up come from somewhere else: our probes, each with one fixed address per region. If a firewall or WAF is blocking those, allow the addresses listed on About our monitoring probes. The same list is published as JSON at https://uptimeagent.com/probe/ips.json for a firewall rule to read.
If the App logs package is behind a firewall
The App logs package sends from your server, not from a browser, so no Content-Security-Policy applies to it. An outbound firewall on that server can, though.
The package talks to one address: ingest.uptimeagent.com, over HTTPS on port 443. Allow that hostname outbound and nothing else is needed. It never calls app.uptimeagent.com.
There is no fixed IP address to allow. The name points at a load balancer whose addresses change, so a rule written against today’s addresses stops working later. If your firewall can only allow by address, email support@uptimeagent.com and say so; a fixed address is something we can plan for.
If you run your own relay, UPTIMEAGENT_ENDPOINT points the package at it instead. It must be an https:// address; the package refuses anything else at start-up.