Requirements

The snippet is a single JavaScript file without dependencies. This page lists what it needs to run, so you can check your setup, your security policies and your support targets.

WebsiteCopy Anchor Link

BrowserCopy Anchor Link

The snippet is delivered as modern JavaScript and is not converted to older language versions. It uses, among others:

• arrow functions, optional chaining (?.), nullish coalescing (??) and logical assignment (||=)
• URL and URLSearchParams
• MutationObserver and IntersectionObserver
• navigator.sendBeacon() to send events
• localStorage, sessionStorage and cookies

Use a current version of a major browser (Chrome, Edge, Firefox, Safari, Samsung Internet). Old browsers that cannot parse modern syntax, such as Internet Explorer, cannot run the snippet.

Network and Content Security PolicyCopy Anchor Link

If you restrict which domains your pages may contact (for example with a Content Security Policy), allow these:

An example header for the always needed domains and sources, to merge into your existing policy:

Content-Security-Policy: script-src 'self' 'unsafe-eval' https://cdn.ablyft.com; style-src 'self' 'unsafe-inline'; connect-src 'self' https://log.ablyft.com; img-src 'self' https://assets.ablyft.com

'unsafe-eval' and 'unsafe-inline' are needed so that the JavaScript and CSS of your experiments can run, see the points below.

To use the Visual Editor on a site with a strict policy, also add https://editor.ablyft.com to script-src, style-src and img-src, and https://app.ablyft.com to connect-src.

To use the QA tool on a site with a strict policy, also add https://app.ablyft.com to script-src, style-src and img-src, and data: to img-src.

If your project uses a custom tracker URL or custom snippet location, the domains differ. Those settings are managed by ABlyft support.

Further points that matter for strict policies:

• The snippet runs the JavaScript of your project, experiments, variations, audiences and prerequisite rules with eval and new Function. script-src therefore needs 'unsafe-eval', otherwise that code does not run.
• The CSS of your project, variations and editor extensions is added to the page as <style> elements. The snippet does not support nonces or hashes, so style-src needs 'unsafe-inline'. The same applies to style attributes in HTML that Visual Editor changes insert.
• The anti-flicker mode hides the page via document.documentElement.style. A Content Security Policy does not block this, so it needs no extra rule.

iFramesCopy Anchor Link

By default, the snippet does not run inside an iFrame. If you want to test content in an iFrame, enable Allow in iFrames under Settings → Project Settings → Project Activations Settings, and add the snippet to the page inside the iFrame. Alternatively, set window.ablyftAllowIframe = true before the snippet loads, see Window flags.

BotsCopy Anchor Link

Visitors whose user agent contains words like bot, google, crawler, spider, robot, crawling or facebookexternalhit are treated as bots. The snippet does nothing for them: they do not see variations and are not tracked.

Cookies and storageCopy Anchor Link

The snippet stores a small amount of data in the visitor's browser, by default in localStorage. The storage is how ABlyft remembers which variation a visitor has seen. See Storage & privacy for the full list.

Next stepsCopy Anchor Link