How to recognize it
Feedback fails to submit, or screenshots come out without images or fonts, and your browser's developer console shows a message like:
Access to XMLHttpRequest at 'https://api.userback.io/?postWidget' from origin 'https://your-website.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Why it happens
Browsers block requests between different domains unless the server allows them. This is called CORS (cross-origin resource sharing). It often starts after:
An update to your website or hosting.
Stricter security settings.
Changes to your Content Security Policy (CSP) that affect loading fonts or other resources from outside services like Userback.
How to fix it
Add a CORS header to your website's server settings. Either allow all:
Access-Control-Allow-Headers: *
Or allow Userback's screenshot service only:
Access-Control-Allow-Headers: screenshot.userback.io
If you don't manage your website's server, send this article to your developer.
Check it worked
Reload the page, submit a test piece of feedback, and check the console for new CORS errors. You can also confirm the code is detected by running Verify Installation on the Install Userback page.
Still stuck?
Contact support with the full console error and the page URL.