# Form integration issues on a website built with PHP

**URL:** <https://community.hubspot.com/t/form-integration-issues-on-a-website-built-with-php/121375>\
**Category:** APIs & Integrations\
**Tags:** forms\
**Created:** [November 26, 2024, 10:15am UTC](https://community.hubspot.com/t/form-integration-issues-on-a-website-built-with-php/121375 "2024-11-26T10:15:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bcnserveis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/bcnserveis/32/204535_2.png) [@Bcnserveis](https://community.hubspot.com/u/Bcnserveis)\
**Post date:** [November 26, 2024, 10:15am UTC](https://community.hubspot.com/t/form-integration-issues-on-a-website-built-with-php/121375/1 "2024-11-26T10:15:23Z")

</div>

We have created a HubSpot form for a moving company website, and it has always worked well for us. However, since we haven’t accessed the panel in several months, the forms have stopped displaying. Today, we accessed the panel and saw that it is still active and the code on the moving company website is correct, but it still does not display. Do we need to wait a certain number of hours for the system to detect it? From the chat, we were told that the account is active and to report our client’s issue here. Thank you very much. Example: [Presupuesto mudanza Barcelona | Mudanzas La Barcelonesa](https://www.mudanzaslabarcelonesa.com/presupuesto)

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [November 26, 2024, 3:40pm UTC](https://community.hubspot.com/t/form-integration-issues-on-a-website-built-with-php/121375/2 "2024-11-26T15:40:37Z")

</div>

Hi, @Bcnserveis 👋 You can see the error in the Page Inspector:

`Refused to load the script 'https://js-eu1.hsforms.net/forms/embed/v2.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.`

You’ll need to work with your devs on finding a fix, as this is not a “HubSpot” error, but is related to how your page is set up. I found this Stack Overflow thread with some suggestions you might investigate — [**Link**](https://stackoverflow.com/questions/31211359/refused-to-load-the-script-because-it-violates-the-following-content-security-po/31219814#31219814).

Best,

Jaycee

---

<div class="post-metadata">

**Author:** ![Bcnserveis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/bcnserveis/32/204535_2.png) [@Bcnserveis](https://community.hubspot.com/u/Bcnserveis)\
**Post date:** [November 26, 2024, 4:35pm UTC](https://community.hubspot.com/t/form-integration-issues-on-a-website-built-with-php/121375/3 "2024-11-26T16:35:40Z")

</div>

Thanks very much Jaycee!!, the issue its due to our htaccess we have this code at the begining.

# Cabeceras de seguridad  
Header always set X-Content-Type-Options “nosniff”  
Header always set X-XSS-Protection “1; mode=block”  
Header always set Expect-CT “max-age=7776000, enforce”  
Header always set Referrer-Policy “no-referrer-when-downgrade”  
Header always set Content-Security-Policy “default-src ‘self’; img-src ‘self’ [https://www.mudanzaslabarcelonesa.com](https://www.mudanzaslabarcelonesa.com); script-src ‘self’ ‘unsafe-inline’; style-src ‘self’ ‘unsafe-inline’;”  
Header always set X-Frame-Options “SAMEORIGIN”  
Header always set Strict-Transport-Security “max-age=31536000; includeSubDomains”  
Header set Permissions-Policy “accelerometer=(), geolocation=(‘self’), vibrate=()”  
# Fin Cabeceras

If I remove it the form work fine again, thanks a lot!!

---

<div class="post-metadata">

**Author:** ![Bcnserveis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/bcnserveis/32/204535_2.png) [@Bcnserveis](https://community.hubspot.com/u/Bcnserveis)\
**Post date:** [November 26, 2024, 4:40pm UTC](https://community.hubspot.com/t/form-integration-issues-on-a-website-built-with-php/121375/4 "2024-11-26T16:40:06Z")

</div>

I try to disable, enable options in the htaccess and finally the origen of the issue is this line:

#Header always set Content-Security-Policy “default-src ‘self’; img-src ‘self’ [https://www.mudanzaslabarcelonesa.com](https://www.mudanzaslabarcelonesa.com); script-src ‘self’ ‘unsafe-inline’; style-src ‘self’ ‘unsafe-inline’;”