Fixing Pages That Fail to Load Because of Security Headers

If a funnel step shows missing images, broken styles or scripts that never run after you added security headers, the header values are probably too strict or malformed.

Where They Live

Go to Sites > Funnels, open the affected funnel, and look at its Security tab (also reachable through Sites > Settings). Custom headers there may include Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and X-Frame-Options.

Common Causes

• A Content-Security-Policy that blocks the platform's own assets or third-party tools you use.
• Line breaks or invalid characters in the value.
• A typo in a URL after editing.
• Rules added without understanding their effect.

Troubleshoot Step by Step

1. Open the Security tab and review each custom header.
2. Temporarily clear all of them and save.
3. Reload the page in a private window. If it loads, one header was responsible.
4. Add headers back one at a time, retesting after each.
5. Keep every value on a single continuous line. A valid example is default-src 'self'; img-src *; script-src 'self' https://example.com;.
6. If the home step still fails, try giving it a different path temporarily.

Prevent Repeats

Keep policies simple, include every domain your page legitimately loads from (forms, calendars, video, analytics), and avoid unsupported directives. Clear your cache or use a private window to confirm each change.

Good to know: A restrictive policy that silently blocks embedded forms or video is the most common reason a page "works" in preview but not live.