Using the Pertento Editor with CSP

The Pertento Editor loads your site inside an iframe. If your site uses strict Content Security Policies (CSP) or X-Frame-Options headers, the editor may show a blank white page because the iframe is blocked.

Why this happens

If your site sends headers like:

• Content-Security-Policy: frame-ancestors 'none'
• Content-Security-Policy: frame-ancestors https://yourdomain.com
• X-Frame-Options: DENY
• X-Frame-Options: SAMEORIGIN

then the Pertento Editor cannot load your site within the preview frame.

Whitelisting Pertento using wildcard support

If you have many Pertento subdomains, you can use CSP wildcard rules.

CSP supports wildcards for frame ancestors as long as they follow this format:

frame-ancestors https://*.pertento.ai;

This allows any Pertento subdomain to embed your website inside the editor.

This is the recommended approach if your installation may be accessed across multiple Pertento environments or if you want to future-proof your setup.

Example CSP configuration

Content-Security-Policy: frame-ancestors https://*.pertento.ai https://yourdomain.com;

You can include additional allowed ancestors if needed.

Alternative: browser plugin workaround

If updating CSP is not possible, developers and QA teams can use a local browser extension that strips X-Frame-Optionsand frame-ancestors for their own browser.

This allows the editor to load correctly without changing production settings.

This method does not affect real visitors; it only bypasses iframe restrictions in your local browser.

Notes

• CSP issues affect only the visual editor, not experiment execution.
• Whitelisting via wildcard is safe and simplifies maintenance if many subdomains are involved.
• A white page in the editor almost always indicates CSP or iframe restrictions.