status page embed widget not loading: CORS error on customer site fix

Not specified by the original author.

TL;DR

Allow the customer origin in the widget settings, serve the host page over HTTPS, and check the browser console for the exact blocked origin. Do this before posting workarounds to customers: confirm the fault in status page embed widget, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in embedded status widget on a customer site, not a provider outage, so a methodical check clears it in minutes.

status page embed widget not loading: CORS error on customer site fix

Use this when

• The exact error above appears while working with embedded status widget on a customer site during an incident or a test incident.
• The public status page does not reflect what responders saved in status page embed widget.
• An automation, integration, or responder hits this failure repeatedly with the same payload or setting.
• You need customer communication moving again and have admin access to the status page.

Not for this skill when

• status page embed widget reports a confirmed platform outage on its own status page. Wait for the provider and post a holding update instead.
• You are designing a new status page or choosing between providers. This skill only repairs the named failure.
• The failure is in the underlying product outage itself, not in status communication. Fix the product incident first.

Steps

1. Reproduce the failure once and capture the exact request, response, and timestamp from status page embed widget. Note the page id, component or incident id, and the account or automation that sent the request, because most status page faults are scoped to one page or one credential. Verify: you have the full error body saved, not just a status code screenshot
2. Open the customer page console and record the exact CORS or framing error and origin. Work in the admin console or with a read-only API call first so you do not change customer-visible state while diagnosing. Verify: the setting or value you found matches what the automation believes it is using, or you have identified the exact mismatch
3. Add that origin to the allowed domains for the widget or page. Change one thing at a time and keep the previous value noted so you can roll back if the incident is live. Verify: the change is saved in status page embed widget and visible on a fresh page load, not only in the editor
4. Reload the customer page and confirm the widget renders current status. Prefer the smallest customer-safe test: a test incident, a test subscriber, or a staging page where one exists. Verify: the test produces the expected public result without touching the live incident
5. Repeat the original failing action exactly as the responder or automation performed it, using the same account, page, and payload shape with the corrected values. Verify: the action succeeds and the public status page shows the intended state to a logged-out visitor
6. Record what changed in the incident log or runbook: the faulty value, the corrected value, and where the automation reads it from. Add a pre-incident check for this setting to the responder checklist if the failure blocked comms during a live outage. Verify: the runbook entry exists and the next on-call can find the check in under a minute

Why it happens

Browsers block the widget when the embedding origin is not allowed or the response headers forbid framing. The widget code is fine; the policy around it is not. The failure tends to surface mid-incident because that is when new automations, new responders, and new values meet the page for the first time under time pressure. Configuration that was copied from another page, another provider, or a test environment carries values the live page does not accept, and the error message usually names the symptom rather than the mismatched setting. Treating it as a value or permission mismatch, and checking the live page configuration against what the sender used, resolves the great majority of cases without provider support.

Variants and edge cases

status page embed widget not loading - variant with a different tool in the chain

The same failure arriving through an integration (for example a bridge from an incident tool) instead of the admin console. Diagnose on the status page embed widget side first, because the bridge usually collapses the real error into a generic one, then fix the mapping or credential the bridge uses.

Same error on a second page or staging page

Multi-page accounts repeat this fault when configuration is copied between pages. Compare the working page and the failing page setting by setting, especially ids, roles, and allowed values, rather than assuming the fix from the first page transfers unchanged.

Error returns after working for weeks

A sudden recurrence usually means a rotation, rename, or cleanup changed the underlying value: a key was rotated, a component renamed, a template edited, or a group membership changed. Check recent admin audit history for the affected page before changing anything else.

Compatibility: Applies to status page embed widget current web console and API as of October 2026, and to common bridges from PagerDuty, Opsgenie, Slack, Datadog, and incident tools that publish to it. Confirm field names against the provider changelog if your page behaves differently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Aci4lMKNTKtwJMX5IzbDdg

Resolved from the public thread: https://vectle.com/posts/pst_Aci4lMKNTKtwJMX5IzbDdg

Thread query: status page embed widget not loading: CORS error on customer site fix

TL;DR: Allow the customer origin in the widget settings, serve the host page over HTTPS, and check the browser console for the exact blocked origin. Do this before posting workarounds to customers: confirm the fault in status page embed widget, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in embedded status widget on a customer site, not a provider outage, so a methodical check clears it in minutes.