We’d like to let you know that we recently experienced a service issue that affected the delivery of form submission notifications, as well as account password reset and verification emails.
We understand how important timely and reliable communication is for your business, and we sincerely apologize for any inconvenience this may have caused.
The good news is that the issue has been fully resolved, and all notifications are now being delivered as expected.
If you experienced any issues with account-related emails, please try resetting your password or verifying your account again — everything should work properly now.
New form submissions are also being delivered successfully. To find any submissions that may have been missed during the affected period, please download the CSV file from your dashboard:
Sorry to hear that your forms are still not working properly. I’ve shared the details with our development team and asked them to investigate the issue.
I’ll keep you updated as soon as we have more information.
We’ve investigated the issue and found that the form submission is failing because of your website’s Content Security Policy (CSP) settings.
Your current CSP configuration blocks the CAPTCHA script required for the form protection to work correctly. As a result, the CAPTCHA verification cannot be completed, and the form submission is rejected:
To fix this, please update your CSP settings and add 'unsafe-eval' to the script-src directive.
After updating the CSP configuration, please clear your website cache and try submitting the form again.
Let us know if the issue persist, we’ll be happy to take another look
I’m unsure how, or even if, we are able to update the CSP settings for our website. Our website is built and hosted through InkSoft, and as far as I know, we are only able to embed the Elfsight forms into our website through HTML blocks. I don’t believe we have access to the server-level CSP settings ourselves.
I can reach out to InkSoft directly, but unfortunately their support can take quite a while to respond, and if changing the CSP isn’t functionality already available within their store builder, I’m not sure they will be able to provide a solution.
In the meantime, is there anything that can be done on the Elfsight/form side to restore the form functionality without requiring the ‘unsafe-eval’ CSP change?
We collect all of our custom sign orders through our Elfsight form, and we are currently in our busy season, receiving 10+ sign orders per day. With the form currently unable to submit, we are potentially losing a significant number of orders each day, so any temporary workaround or alternative CAPTCHA configuration you can provide would be extremely helpful.
I’m sorry for the inconvenience this issue has caused. I completely understand the urgency here and how important it is to get this resolved as soon as possible.
I’ve already passed your feedback to our developers and we’ll check what can be done here. I’ll get back to you with any updates as soon as I hear from them.
I’ve talked to the devs and here is what they’ve shared.
The form doesn’t submit because your site’s Content-Security-Policy (CSP) blocks part of our spam protection (Cap). It needs a web worker created from a blob: URL, and also WebAssembly plus API calls to our captcha host.
Please ask your hosting / platform support (InkSoft) to update the CSP HTTP response header (this usually can’t be changed from a page editor). Ask them to allow at least:
If the policy has no worker-src, browsers fall back to script-src / default-src — in that case blob: must be allowed there instead.
Keep any existing sources; only add the lines above.
After the header is live, hard-refresh the page and try submitting again.
This has to be fixed on the website host side — it can’t be changed from Elfsight widget settings, and we can’t turn off captcha for the form.
Temporary workaround while CSP is updated: embed the form with our iframe / website embed (works for page embeds; a floating button embed may still hit the same CSP).
If it still fails, please send a screenshot of the exact CSP error from the browser console (F12 → Console).
I really appreciate you and your developers providing such thorough details regarding this issue!
Your iframe workaround appears to be working for now! I did have to adjust the embed code slightly because we were running into an intermittent loading issue where the iframe would sometimes load before the iframe-resizer script was available. When that happened, the form wouldn’t resize properly and would be cut off. I adjusted the code so the iframe resizer finishes loading before it initializes the form, and so far that seems to have resolved the issue.
I’ve also sent a support request to InkSoft with all of the CSP information your developers provided, so hopefully I hear back from them soon. I’ll update you once I know more!
