> ## Content Index
> Fetch the complete content index at: https://blog.tsd.digital/llms.txt
> Use this file to discover other available public pages before exploring further.

# Sitefinity/Ucommerce admin area - The content is blocked. Contact the site owner to fix the issue.
- URL: https://blog.tsd.digital/sitefinityucommerce-admin-area-the-content-is-blocked-contact-the-site-owner-to-fix-the-issue/
- Published: 2023-02-01T16:22:17.000Z
- Updated: 2025-04-01T04:47:54.000Z
- Author: Tim Gaunt
- Tags: #Import 2025-04-01 05:39

Loading the Ucommerce admin area in Sitefinity we were hitting ​a rather unfriendly error message "The content is blocked. Contact the site owner to fix the issue.​"

The fix is relatively simple -edit \`App\_Data/Sitefinity/Configuration/WebSecurityConfig.config​\` and add "'self'" to both "frame-src" and "frame-ancestors" so it looks like this:

```xml
<?xml version="1.0" encoding="utf-8"?>
<webSecurityConfig
  xmlns:config="urn:telerik:sitefinity:configuration"
  xmlns:type="urn:telerik:sitefinity:configuration:type" config:version="14.3.8000.0">
  <httpSecurityHeaders>
    <responseHeaders>
      <add name="Content-Security-Policy" config:flags="1">
        <directives>
          <remove name="frame-src" />
          <add name="script-src" config:flags="1">
            <values>
              <remove value="https://www.youtube.com" />
              <remove value="https://*.googletagmanager.com" />
              <add value="https://www.youtube.com/iframe_api" />
              <add value="https://dec.azureedge.net/" />
              <add value="munchkin.marketo.net" />
              <add value="use.fontawesome.com" />
              <add value="stackpath.bootstrapcdn.com" />
              <add value="*.livechatinc.com" />
            </values>
          </add>
          <add name="style-src" config:flags="1">
            <values>
              <add value="*.livechatinc.com" />
            </values>
          </add>
          <add name="img-src" config:flags="1">
            <values>
              <remove value="i.ytimg.com" />
              <remove value="https://*.googletagmanager.com" />
              <add value="https://*.insight.sitefinity.com" />
              <add value="https://*.dec.sitefinity.com" />
              <add value="*.awwwards.com" />
              <add value="*.livechatinc.com" />
            </values>
          </add>
          <add name="font-src" config:flags="1">
            <values>
              <add value="*.livechatinc.com" />
            </values>
          </add>
          <add name="frame-src">
            <values>
              <add value="'self'" />
            </values>
          </add>
          <add name="connect-src" config:flags="1">
            <values>
              <remove value="data:" />
              <remove value="*.gstatic.com" />
              <remove value="https://*.googletagmanager.com" />
              <add value="*.mktoresp.com" />
              <add value="*.livechatinc.com" />
            </values>
          </add>
          <add name="media-src" config:flags="1">
            <values>
              <add value="https://cdn.livechatinc.com/widget/static/media/new_message.a37211a6.ogg" />
            </values>
          </add>
          <add name="child-src" config:flags="1">
            <values>
              <remove value="https://www.youtube-nocookie.com" />
              <add value="*.livechatinc.com" />
            </values>
          </add>
          <add name="frame-ancestors">
            <values>
              <add value="'self'" />
            </values>
          </add>
        </directives>
      </add>
      <add disabled="True" name="Cross-Origin-Embedder-Policy" config:flags="1" />
      <add disabled="True" name="Cross-Origin-Opener-Policy" config:flags="1" />
      <add disabled="True" name="Cross-Origin-Resource-Policy" config:flags="1" />
      <add disabled="True" name="Permissions-Policy" config:flags="1" />
    </responseHeaders>
  </httpSecurityHeaders>
  <csrfProtection enable="False" />
</webSecurityConfig>
```