Sitefinity/Ucommerce admin area - The content is blocked. Contact the site owner to fix the issue.

Loading the Ucommerce admin area in Sitefinity we were hitting ​a rather unfriendly error message "The content is blocked. Contact the site owner to fix the issue.​"

The fix is relatively simple -edit `App_Data/Sitefinity/Configuration/WebSecurityConfig.config​` and add "'self'" to both "frame-src" and "frame-ancestors" so it looks like this:

<?xml version="1.0" encoding="utf-8"?>
<webSecurityConfig xmlns:config="urn:telerik:sitefinity:configuration" xmlns:type="urn:telerik:sitefinity:configuration:type" config:version="14.3.8000.0">
<httpSecurityHeaders>
<responseHeaders>
<add name="Content-Security-Policy" config:flags="1">
<directives>
<remove name="frame-src" />
<add name="script-src" config:flags="1">
<values>
<remove value="https://www.youtube.com" />
<remove value="https://*.googletagmanager.com" />
<add value="https://www.youtube.com/iframe_api" />
<add value="https://dec.azureedge.net/" />
<add value="munchkin.marketo.net" />
<add value="use.fontawesome.com" />
<add value="stackpath.bootstrapcdn.com" />
<add value="*.livechatinc.com" />
</values>
</add>
<add name="style-src" config:flags="1">
<values>
<add value="*.livechatinc.com" />
</values>
</add>
<add name="img-src" config:flags="1">
<values>
<remove value="i.ytimg.com" />
<remove value="https://*.googletagmanager.com" />
<add value="https://*.insight.sitefinity.com" />
<add value="https://*.dec.sitefinity.com" />
<add value="*.awwwards.com" />
<add value="*.livechatinc.com" />
</values>
</add>
<add name="font-src" config:flags="1">
<values>
<add value="*.livechatinc.com" />
</values>
</add>
<add name="frame-src">
<values>
<add value="'self'" />
</values>
</add>
<add name="connect-src" config:flags="1">
<values>
<remove value="data:" />
<remove value="*.gstatic.com" />
<remove value="https://*.googletagmanager.com" />
<add value="*.mktoresp.com" />
<add value="*.livechatinc.com" />
</values>
</add>
<add name="media-src" config:flags="1">
<values>
<add value="https://cdn.livechatinc.com/widget/static/media/new_message.a37211a6.ogg" />
</values>
</add>
<add name="child-src" config:flags="1">
<values>
<remove value="https://www.youtube-nocookie.com" />
<add value="*.livechatinc.com" />
</values>
</add>
<add name="frame-ancestors">
<values>
<add value="'self'" />
</values>
</add>
</directives>
</add>
<add disabled="True" name="Cross-Origin-Embedder-Policy" config:flags="1" />
<add disabled="True" name="Cross-Origin-Opener-Policy" config:flags="1" />
<add disabled="True" name="Cross-Origin-Resource-Policy" config:flags="1" />
<add disabled="True" name="Permissions-Policy" config:flags="1" />
</responseHeaders>
</httpSecurityHeaders>
<csrfProtection enable="False" />
</webSecurityConfig>