Important: Pendo retired classic Feedback on August 1, 2026. Pendo Listen replaces it as Pendo's latest qualitative insights tool. If you have classic Feedback data you still need to retrieve, you can do so until November 1, 2026. After this date, all classic Feedback will be permanently deleted. See Keep your classic Feedback data for more information.
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. If you're running into an issue with your CSP, you might need to make an adjustment to allow full functionality.
This article outlines the minimum required directives to allow Feedback full functionality. If you need to enable CSP for Pendo’s Engage (Insights & Guidance) platform, see the original Content Security Policy (CSP) article.
Minimum Required Directives
foo.example.com below with your hostname. You may include https:// before any hostnames if desired.Minimum Required CSP Directives For US/Worldwide Non-EU Clients:
Full functionality, including embedding Feedback in the Pendo Resource Center:
connect-src foo.example.com api.feedback.us.pendo.io
frame-src foo.example.com portal.feedback.us.pendo.ioIn addition, while using Visual Design Studio:
script-src 'unsafe-inline' 'unsafe-eval'If you're using the widget view for visitor access to Feedback:
style-src 'unsafe-inline'Minimum requirements for Feedback to function:
connect-src foo.example.com api.feedback.us.pendo.ioMinimum Required CSP Directives For EU Clients:
Full functionality, including embedding Feedback in the Pendo Resource Center
connect-src foo.example.com api.feedback.eu.pendo.io
frame-src foo.example.com portal.feedback.eu.pendo.ioIn addition, while using Visual Design Studio:
script-src 'unsafe-inline' 'unsafe-eval'If you're using the widget view for visitor access to Feedback:
style-src 'unsafe-inline'Minimum requirements for Feedback to function
connect-src api.feedback.eu.pendo.io