Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.fitmyvehicle.com.au/llms.txt

Use this file to discover all available pages before exploring further.

CSP DirectiveValue to AddWhy
script-srchttps://cdn.fitmyvehicle.com.auLoads the fmv.js embed script
frame-srchttps://cdn.fitmyvehicle.com.auWidget opens as an iframe from the CDN
connect-srcNot neededAll API calls happen inside the iframe, not on your page
style-srcNot neededThe script uses element.style.cssText (DOM manipulation, not a <style> tag) — no CSP style directive changes needed

​
Minimal CSP addition

script-src https://cdn.fitmyvehicle.com.au;
frame-src https://cdn.fitmyvehicle.com.au;
CSP is the #1 cause of “Builder won’t open.” If your site has a strict CSP and you haven’t whitelisted the FMV domains, the browser will silently block the script or iframe. Check your browser console (F12) for CSP violation errors.

​
How to check if you have a CSP

Open your browser’s developer tools (F12), go to the Network tab, reload the page, click on the main document request, and look for a Content-Security-Policy response header. If there isn’t one, you don’t need to do anything here.

​
Not sure if this applies?

Most small-to-medium business websites don’t have a CSP. If the Builder opens fine after installation, you can skip this page entirely.

​
Other security headers

These common security headers do not need any changes for the FMV widget:
HeaderImpact
X-Frame-OptionsControls whether your page can be iframed by others. Does not affect your ability to iframe the FMV widget. No changes needed.
Permissions-PolicyThe widget does not use geolocation, camera, microphone, or any restricted browser APIs. No changes needed.
Referrer-PolicyThe widget does not rely on referrer headers from your page. No changes needed.