Embedding refused to connect

You dropped your Overskill app into an iframe on a page you own — a ClickFunnels funnel step, a WordPress post, a Webflow page — and the frame is blank or says refused to connect. Chrome's console shows something like:

Refused to frame 'https://yourapp.overskill.app/' because an ancestor violates the
following Content Security Policy directive: "frame-ancestors 'self' https://overskill.com ..."

This is expected, and it's a one-time setting to fix.

Why it happens

Every published Overskill app ships a Content-Security-Policy: frame-ancestors header. That header tells the browser which sites are allowed to put the app inside an <iframe>. By default it lists only Overskill's own surfaces (the editor, previews, and the ClickFunnels AI builder) — so nobody else can frame your login or checkout and clickjack your users.

Your own funnel page is someone else to the browser until you say otherwise. You opt in per app.

Fix: allow your site

This is a Settings change — the AI in chat can't do it for you.

1. Open the app in the editor: https://www.overskill.com/account/apps/<your-app-id>/editor.
2. Open Settings (gear icon in the dashboard sidebar; or add ?dashboard=settings to the editor URL).
3. Scroll to the Embedding card (Choose which of your other sites are allowed to show this app inside an iframe).
4. In Allowed embedding sites, enter the origin of the page that hosts the iframe — one per line, each starting with https://.
5. Click Save Embedding Settings. You'll see a confirmation banner. (Reload Settings and the saved sites appear as chips under the box.)
6. Click Publish (top right). Saving alone does nothing to the live app — the list is baked into your app when it's published. The Publish button lights up as soon as you save, and the publish panel shows the change as pending.
7. Hard-refresh the page that contains the iframe (a tab you already had open still carries the old header).

What to type: origin format

An origin is scheme + host (+ optional port). No path, no query string, no trailing page name.

Where your page lives	Type this
https://funnel.example.com/my-offer	https://funnel.example.com
https://www.example.com/blog/post	https://www.example.com
Apex AND www both serve the page	https://example.com and https://www.example.com (two lines — the browser treats them as different sites)
Any subdomain of a domain you own	https://*.example.com (does not cover the apex https://example.com — add it separately)
A staging server on a port	https://staging.example.com:8443

Rules the box enforces:

• Must start with https://. http://, data:, file: etc. are rejected — the host page must itself be https.
• Up to 10 sites per app.
• Duplicates and any of Overskill's own origins are ignored (already allowed).
• https://* and https://*.com are rejected.
• Wildcards over shared hosts are rejected: https://*.vercel.app, https://*.github.io, https://*.pages.dev, https://*.co.uk, https://*.overskill.app… A wildcard there would let every site on that platform embed your app. Name your exact site instead (https://myproject.vercel.app is fine).
• Trailing / is tolerated and dropped. Anything else after the host (/page, ?x=1, #top) is rejected with must not include a path, query string or fragment.

Each entry is validated when you save (you'll see the reason inline) and re-validated when the app is published, so a bad entry can never break your app's header.

ClickFunnels specifically

Allow the domain your funnel is served from — that's your funnel's custom domain (e.g. https://offers.yourbrand.com), or if you're on a ClickFunnels-provided domain, that exact host (e.g. https://yourbrand.myclickfunnels.com). The editor/preview inside ClickFunnels is a different origin from the published funnel, so if you want the embed to render while editing too, add that host as well. Don't add https://*.myclickfunnels.com — that's a shared host and is rejected.

Custom domains: which side matters?

Only the host page's origin goes in the list. It doesn't matter whether your Overskill app is on yourapp.overskill.app or your own custom domain — the app is the thing being framed, not the framer. (Connecting a custom domain to your app is a separate step: Connecting your own domain.)

Preview vs live

The allow-list applies to the published app only. The in-editor preview keeps working regardless, and the preview is not embeddable on outside sites. Change the list → Publish → the live app picks it up on that deploy.

What this does not do

• It only affects <iframe> embeds. Linking to the app or opening it in a new tab was never blocked.
• It does not change who can use the app — visibility, sign-in and payments are separate settings.
• Each app has its own list. Allowing a site on one app doesn't allow it on another.
• Leaving the box empty is the default and the safest option: the app can only be framed inside Overskill.

Troubleshooting

Symptom	Check
Still refused to connect after saving	Did you Publish after saving? Saving ≠ publishing. Look for the pending-changes indicator on the Publish button.
Works in a fresh tab, not the old one	Hard refresh (Cmd/Ctrl-Shift-R) the host page — the old CSP response is cached by the open tab.
Works on www., not on the bare domain (or vice versa)	They're separate origins. Add both lines.
Works on the live funnel, not in the ClickFunnels editor	The editor renders from a different origin. Add that origin too, or test on the published funnel URL.
cannot wildcard a shared domain on save	You tried https://*.<shared platform>. Use the exact host of your page.
must start with https://	The host page is http://. Switch the host page to https — the browser won't frame an https app from an http page in a way that passes this check.
Console says the blocked ancestor is https://something-else	Read the frame-ancestors line in the console error: it lists exactly what IS allowed. The origin named as blocked is the one to add.
Changed the list but Publish is greyed out	Reload the editor — a saved Embedding change should already mark the app as having unpublished changes. If the button still won't enable, contact support with the app id.

What to read next

• Embed your app on another site
• Preview vs live: how publishing works
• Connecting your own domain