Local CSP Testing

Before submitting your game, you should verify it works correctly under the Content Security Policy enforced by Greenhouse Games. Testing locally catches issues early and avoids rejected submissions.

Add the CSP Meta Tag

Copy and paste the following <meta> tag as the first element inside your <head> tag in every HTML file:

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; connect-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; frame-src 'self' blob:; worker-src 'self' blob:">

Your HTML should look something like this:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; connect-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; frame-src 'self' blob:; worker-src 'self' blob:">
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>My Game</title>
  <!-- your other head content -->
</head>
<body>
  <!-- your game content -->
</body>
</html>

The CSP meta tag must come before any other <meta>, <link>, or <script> tags to ensure the policy is enforced before any resources are loaded.

Serve Your Game Locally

CSP with 'self' requires your files to be served over HTTP — opening HTML files directly with file:// won’t work correctly. Use any local development server:

# Using Python
python -m http.server 8080

# Using Node.js (npx, no install needed)
npx serve .

# Using PHP
php -S localhost:8080

Then open http://localhost:8080 in your browser.

Check for CSP Violations

Open your browser’s Developer Tools (F12) and look at the Console tab. CSP violations appear as error messages like:

Refused to load the script 'https://cdn.example.com/lib.js' because it
violates the following Content Security Policy directive: "script-src 'self'
'unsafe-inline' 'unsafe-eval' blob:".

Common violations to look for:

Violation Message	What It Means	Fix
Refused to load the script…	External script blocked	Bundle the script locally
Refused to load the stylesheet…	External CSS blocked	Bundle the stylesheet locally
Refused to connect to…	External network request blocked	Remove the external request
Refused to load the font…	External font blocked	Include font files in your bundle
Refused to load the image…	External image blocked	Include image files in your bundle

Verification Checklist

Run through this checklist with the CSP meta tag in place:

Game loads without console errors

No CSP violation messages appear in the browser console on initial load.

All game screens render correctly

Navigate through all game states — menus, gameplay, pause screens, game-over screens — and verify no resources fail to load.

Audio and visual assets load

Confirm all images, sprites, sounds, and fonts display/play correctly.

No network requests to external domains

Open the Network tab in DevTools and confirm all requests go to localhost (or your local server). Filter by “third-party” if your browser supports it.

Web Workers function correctly

If your game uses Web Workers, verify they initialize without errors.

Troubleshooting

Game works without the meta tag but breaks with it: This means your game relies on external resources. Check the console for specific CSP violations and bundle those resources locally. “Refused to connect” errors for API calls: Your game is making network requests to external servers. Under the platform CSP, only same-origin requests are permitted. Remove external API calls or find offline alternatives. Fonts not rendering: If you’re loading fonts from Google Fonts or another CDN, download the font files and include them in your bundle. Update your CSS @font-face declarations to reference local paths. Game engine scripts fail to load: If you’re loading a game engine (Phaser, PixiJS, Three.js, etc.) from a CDN, download the library and include it in your bundle.

Important Notes

Remove the meta tag before submitting. The platform injects the CSP automatically during deployment. If you leave your testing meta tag in, you’ll end up with a duplicate (though this won’t cause issues since the injected one takes precedence by position).
The meta tag approach accurately simulates the production CSP behavior, but remember that the blocked JavaScript APIs (localStorage, sessionStorage, etc.) are enforced separately by the security scan — the CSP meta tag alone won’t catch those issues.
Test in multiple browsers if possible. CSP enforcement is consistent across modern browsers, but edge cases in older browser versions may differ.

Onboarding

Game Submission Guide

Allowed Asset Types

Security Restrictions

Content Security Policy

Local Testing

Local CSP Testing

Add the CSP Meta Tag

Serve Your Game Locally

Check for CSP Violations

Verification Checklist

Troubleshooting

Important Notes

​Local CSP Testing

​Add the CSP Meta Tag

​Serve Your Game Locally

​Check for CSP Violations

​Verification Checklist

​Troubleshooting

​Important Notes

Local CSP Testing

Add the CSP Meta Tag

Serve Your Game Locally

Check for CSP Violations

Verification Checklist

Troubleshooting

Important Notes