> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ghg.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Local Testing

> Test your game against the platform CSP before submitting

# Local CSP Testing

Before submitting your game, you should verify it works correctly under the Content Security Policy enforced by Greenhouse Games. Testing locally catches issues early and avoids rejected submissions.

## Add the CSP Meta Tag

Copy and paste the following `<meta>` tag as the **first element** inside your `<head>` tag in every HTML file:

```html theme={null}
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; connect-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; frame-src 'self' blob:; worker-src 'self' blob:">
```

Your HTML should look something like this:

```html theme={null}
<!DOCTYPE html>
<html lang="en">
<head>
  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; connect-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; frame-src 'self' blob:; worker-src 'self' blob:">
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>My Game</title>
  <!-- your other head content -->
</head>
<body>
  <!-- your game content -->
</body>
</html>
```

<Note>
  The CSP meta tag must come **before** any other `<meta>`, `<link>`, or `<script>` tags to ensure the policy is enforced before any resources are loaded.
</Note>

## Serve Your Game Locally

CSP with `'self'` requires your files to be served over HTTP — opening HTML files directly with `file://` won't work correctly. Use any local development server:

```bash theme={null}
# Using Python
python -m http.server 8080

# Using Node.js (npx, no install needed)
npx serve .

# Using PHP
php -S localhost:8080
```

Then open `http://localhost:8080` in your browser.

## Check for CSP Violations

Open your browser's Developer Tools (F12) and look at the **Console** tab. CSP violations appear as error messages like:

```
Refused to load the script 'https://cdn.example.com/lib.js' because it
violates the following Content Security Policy directive: "script-src 'self'
'unsafe-inline' 'unsafe-eval' blob:".
```

Common violations to look for:

| Violation Message                 | What It Means                    | Fix                                |
| --------------------------------- | -------------------------------- | ---------------------------------- |
| Refused to load the script...     | External script blocked          | Bundle the script locally          |
| Refused to load the stylesheet... | External CSS blocked             | Bundle the stylesheet locally      |
| Refused to connect to...          | External network request blocked | Remove the external request        |
| Refused to load the font...       | External font blocked            | Include font files in your bundle  |
| Refused to load the image...      | External image blocked           | Include image files in your bundle |

## Verification Checklist

Run through this checklist with the CSP meta tag in place:

<Steps>
  <Step title="Game loads without console errors">
    No CSP violation messages appear in the browser console on initial load.
  </Step>

  <Step title="All game screens render correctly">
    Navigate through all game states — menus, gameplay, pause screens, game-over screens — and verify no resources fail to load.
  </Step>

  <Step title="Audio and visual assets load">
    Confirm all images, sprites, sounds, and fonts display/play correctly.
  </Step>

  <Step title="No network requests to external domains">
    Open the Network tab in DevTools and confirm all requests go to `localhost` (or your local server). Filter by "third-party" if your browser supports it.
  </Step>

  <Step title="Web Workers function correctly">
    If your game uses Web Workers, verify they initialize without errors.
  </Step>
</Steps>

## Troubleshooting

**Game works without the meta tag but breaks with it:**
This means your game relies on external resources. Check the console for specific CSP violations and bundle those resources locally.

**"Refused to connect" errors for API calls:**
Your game is making network requests to external servers. Under the platform CSP, only same-origin requests are permitted. Remove external API calls or find offline alternatives.

**Fonts not rendering:**
If you're loading fonts from Google Fonts or another CDN, download the font files and include them in your bundle. Update your CSS `@font-face` declarations to reference local paths.

**Game engine scripts fail to load:**
If you're loading a game engine (Phaser, PixiJS, Three.js, etc.) from a CDN, download the library and include it in your bundle.

## Important Notes

* **Remove the meta tag before submitting.** The platform injects the CSP automatically during deployment. If you leave your testing meta tag in, you'll end up with a duplicate (though this won't cause issues since the injected one takes precedence by position).
* The meta tag approach accurately simulates the production CSP behavior, but remember that the [blocked JavaScript APIs](/security/blocked-apis) (localStorage, sessionStorage, etc.) are enforced separately by the security scan — the CSP meta tag alone won't catch those issues.
* Test in multiple browsers if possible. CSP enforcement is consistent across modern browsers, but edge cases in older browser versions may differ.
