# One-site embed diagnostic

Use this card when an Overskill app opens directly but fails inside a website. Keep the host address, accepted saved settings, publication and actual visitor task separate. Product rules checked October 11, 2026; refresh the [embedding help](https://www.overskill.com/help/articles/embed-your-app-on-another-site) if the product changes.

All addresses and completed results below are fictional examples. No live app was tested for this worksheet. A candidate matching the host is not proof that an embed loads.

## Eight address cases

Read the host page's origin as its scheme and host, plus a specified port. Paths, queries and fragments belong to the page URL, not the origin you enter in the setting. Compare against the **host around the app**, not the app's own address.

Each row compares one candidate setting with one host page. A real app can have several entries and platform-provided origins; this table does not reconstruct its complete published policy.

| Case | Host page | Candidate allowed-site input | Format result | What this one entry tells you |
| --- | --- | --- | --- | --- |
| E1 | `https://www.example.com/book` | `https://example.com` | Accepted by the checked format rule | Different host: the bare domain does not name `www.example.com`. |
| E2 | `https://www.example.com/book?campaign=a#start` | `https://www.example.com` | Accepted by the checked format rule | Names this host origin. The page's path, query and fragment do not require separate entries. Publication and loading remain untested. |
| E3 | `https://example.com/book` | `https://*.example.com` | Accepted by the checked format rule | Does not include the bare domain `example.com`. |
| E4 | `https://events.example.com/book` | `https://*.example.com` | Accepted by the checked format rule | Covers this illustrated subdomain. Actual saved settings, publication and loading remain untested. |
| E5 | `https://www.example.com/book` | `https://www.example.com/book` | Rejected input; not a saved entry | Remove the path from the candidate setting. E2 shows why the full host-page URL can still contain one. |
| E6 | `https://site.github.io/book` | `https://*.github.io` | Rejected input; not a saved entry | This wildcard spans a shared platform. The exact `https://site.github.io` origin is the narrower candidate. |
| E7 | `http://www.example.com/book` | `http://www.example.com` | Rejected input; not a saved entry | The custom allowed-site setting requires HTTPS. Confirm a working HTTPS host page before using its HTTPS origin. |
| E8 | `https://www.example.com:8443/book` | `https://www.example.com:9443` | Accepted by the checked format rule | Different non-default ports. This entry does not name the illustrated host origin. |

There are five accepted candidate formats and three rejected inputs. Two of the five accepted expressions cover their illustrated host origins; three do not. **None of the eight rows is a live-frame test.** These cases do not decide every URL, port or wildcard edge case.

## Completed example: a workshop format chooser

Fictional app: Cedar Workshop's public format chooser. Intended task: choose a workshop format and read its explanation inside the workshop's booking page. Host page: `https://www.cedar-workshop.example/book`. App address: `https://chooser.cedar-workshop.example`. These example addresses are not working demos.

All times below are invented UTC times. “Version A/B” are worksheet labels, not names of Overskill UI fields.

| Record | Time | Observation in the fictional example | Conclusion and next action |
| --- | --- | --- | --- |
| T0 | 09:00 | Direct app opens; embedded page fails. Accepted saved list contains `https://cedar-workshop.example`. Which settings Version A published is unknown. | `www` is missing from this saved entry. Correct the intended exact origin; do not call it the proven sole cause. |
| T1 | 09:04 | `https://www.cedar-workshop.example` is accepted and saved. No completed publish for this change is recorded. | Saved setting corrected; live state unknown. Confirm publication of this change. |
| T2 | 09:08 | The fictional record identifies a completed publish, Version B, after the saved change. No host task result has been recorded. | Publication recorded; task not tested. Reload the real host page and run the visitor task. |
| T3 | 09:11 | Illustrative result: public visitor selects a format and reads the explanation within the final host page. Browser: example desktop browser; exact version would be required in a real record. | Illustrative pass for this public task only. Sign-in, private records and other devices remain not tested. |

For this completed illustration, the useful handover is: “The accepted `www` setting was published in Version B; the named public task passed in the host page in our fictional record. Test the required real browsers and any signed-in journey separately.” Do not reuse that sentence as evidence about your app.

## Blank card for your real site

Keep this in a private project record. Remove tokens, private query values and personal identifiers before sharing it. Use a sanitized address or origin when the complete URL is sensitive.

| Field | Your evidence |
| --- | --- |
| App and person responsible | ___ |
| Intended visitor task, including its finish condition | ___ |
| App's published address, sanitized if needed | Unknown: ___ |
| Final host-page address after redirects | Unknown: ___ |
| Host origin (scheme, host, specified port) | Unknown: ___ |
| Final website or page-builder preview? | Unknown: ___ |
| Outer frame/parent addresses, if known | Unknown: ___ |
| Candidate allowed-site input | ___ |
| Candidate accepted or rejected? Visible response | Not checked: ___ |
| Actual accepted saved entries and observation time | Unknown: ___ |
| Relevant completed publish evidence and time | Unknown: ___ |
| Direct app result | Not tested: ___ |
| Real host-page visitor task result | Not tested: ___ |
| Device, operating system, browser and version | ___ |
| Visitor role and sign-in state | ___ |
| Exact visible error or task result, sanitized | ___ |
| Remaining unknown, responsible person and next action | ___ |

Append a row each time you learn something; do not replace a previous failed result with an unexplained “fixed.”

| Observation time | What changed or was tested | Evidence | Result: pass / fail / not tested / unknown | Next action and owner |
| --- | --- | --- | --- | --- |
| ___ | ___ | ___ | Unknown | ___ |

## Choose one next action

| Evidence you have | Useful next action |
| --- | --- |
| Candidate was rejected | Correct its format using the embedding help. Do not record it as saved. |
| Accepted entries omit the intended host | Add only the intended site, then follow the normal Publish step. |
| Accepted entries cover the host, but relevant publication is unknown | Establish whether that accepted change was published. |
| Publication is recorded, but the real host task has not run | Reload the final host page and complete the stated task on the required browser. |
| The host still fails | Record the exact error, final versus preview context and known parent chain. Investigate the remaining frame or app failure without repeatedly widening the allowed list. |
| The frame loads but sign-in or the visitor task fails | Keep the frame result and the task failure separate. Investigate that task; permitting a host did not prove it works. |

Use [Overskill's embedding instructions](https://www.overskill.com/help/articles/embed-your-app-on-another-site) for settings. For a new useful visitor tool, use the [app brief builder](https://www.overskill.com/learn#brief-builder): describe the task, intended host and public/private boundaries, review the generated brief, edit its input fields and choose Start build. The link imports nothing and changes no embedding setting.