Velaro Chat (our live chat widget) and Velaro Messaging (our messaging widget) load scripts and open connections to several Velaro hosts. If your website sends a Content Security Policy (CSP), it must allow those hosts or the widget will not load, or chat will open but messages will not arrive. This article lists what to allow. Last reviewed: October 17, 2026.

Which Option Should I Use?

Both options below cover both platforms, so the policy keeps working if your account later moves from one Velaro platform to the other. Use the policy that fits how you manage your site.

• Option 1, wildcard (recommended): one short policy. Velaro adds or changes hosts under velaro.com from time to time for redundancy and new services, and this policy keeps working without any change on your side.
• Option 2, explicit list: every host named individually. This is the narrowest policy, but you must update it yourself whenever a host is added or changed.

Option 1: Wildcard (Recommended)

Copy and paste these entries into your existing CSP. If you already have a directive (for example connect-src), add the values to it instead of creating a second one.

Content-Security-Policy:
script-src  'self' https://*.velaro.com https://eastprodcdn.azureedge.net;
connect-src 'self' https://*.velaro.com wss://*.velaro.com https://*.service.signalr.net wss://*.service.signalr.net;
frame-src   'self' https://*.velaro.com https://eastprodcdn.azureedge.net;
img-src     'self' data: https://*.velaro.com https://eastprodcdn.azureedge.net https://galleryuseastprod.blob.core.windows.net https://velaromessagingprod.blob.core.windows.net;
media-src   'self' https://*.velaro.com https://galleryuseastprod.blob.core.windows.net https://velaromessagingprod.blob.core.windows.net;
style-src   'self' 'unsafe-inline';

Everything on velaro.com is covered by the first entry in each line. The remaining entries are hosts that are not under velaro.com (see "Hosts Not Under velaro.com" below). You can leave out the ones that do not apply to you:

We recommend keeping all of the entries, even for a platform or feature you do not use today. A listed host does not mean it is in use right now. We may serve a service from one of these hosts, for example during maintenance, scaling or a migration, and an entry you removed would then block it.

About the Wildcard and Security

https://*.velaro.com allows your pages to load from, and connect to, every current and future subdomain of velaro.com, including ones the widget does not use. That is a wider trust surface than an explicit list. If one of those subdomains were ever misconfigured or taken over, your policy would still allow it. It does not allow any other domain, and it does not allow the bare velaro.com (add it separately if you need it). Some security reviews prefer explicit lists for this reason. If yours does, use Option 2.

Option 2: Explicit List for Both Platforms

Allow every host below. Real-time hosts need both https:// and wss:// entries: the browser first makes an HTTPS request to start the connection, then opens the WebSocket.

Velaro Hosts (under velaro.com)

Hosts Not Under velaro.com

Some content and real-time connections are currently served from Microsoft Azure host names. They are not covered by *.velaro.com, so Option 1 lists them separately.

If you only run one platform, you only need that platform's rows and the shared rows (*.service.signalr.net). We still recommend listing all of them, because accounts can move between platforms and Velaro may route a service through any host listed here.

Which Hosts Does My Installed Script Use?

The Velaro Chat widget script loads its own hosts when it runs. Scripts installed or regenerated before this change may load content from the Microsoft-hosted names above, and some current ones still do. For that reason, keep the entries in the table above, even if you recently reinstalled the script. Listing them is the safe choice, and it keeps both older and newer installed scripts working without any change on your side.

Keeping Your Policy Current

Hosts under velaro.com may be added or changed over time. If you use Option 1, you do not need to change anything for those. If you use Option 2, or you list the hosts that are not under velaro.com, keeping your policy up to date is your responsibility. Where we can, we aim to tell account contacts about host changes in advance, but we do not guarantee notice or timing.

Testing Your Policy

1. Update your CSP, then reload the page that hosts the chat, signed in if your site requires it. A logged-in area often sends a different policy than your public pages.
2. Open your browser developer tools and look in the Console for messages that begin with "Refused to load" or "Refused to connect". The host named in the message is the one to add.
3. Start a chat, have an agent accept and reply, and confirm the reply appears.

Velaro Messaging also supports a nonce on the embed script tag in addition to host allow-listing.

Important Information

Your Content Security Policy is your own decision and your own responsibility. This article is general information about the hosts our products use as of the date above. It is not security, legal or implementation advice, and it is provided as is, without any warranty or guarantee that a policy built from it will meet your requirements or work with your site. Velaro does not configure, review or approve your policy and is not responsible for content that your policy blocks or allows. Please review any change with your own security team and test it before deploying it.