MOVEit Application site Layout not loading properly in Edge and Chrome browsers

When you open the web page from MOVEit in Chrome or Edge or other browsers apart form IE the page does not display correctly like some parts are disabled. If you look in chrome developer tools content security policy will show parts are blocked due to policy violations

Jun 1, 2026
Knowledge

Title

URL Name

moveit-application-site-layout-not-loading-properly-in-edge-and-chrome-browsers

Article Number

000213420

Environment

Product: MOVEit Transfer Version: 2025.0, 2025.1, 2026.0 OS: All supported platforms

Question/Problem Description

The MOVEit Application site is not loading properly in Edge and Chrome browsers and images are not showing properly and text is appearing while loading the site in Chrome and edge browsers.

error

Steps to Reproduce

1. Upgrade the Transfer server to version the latest release. 2. Open Google chrome 3. Hit the F12 key to launch the developer tools window 4. Log into Transfer 5. Attempt to upload or download a file 6. Click on the Console tab in the developer tools window to view the error

Clarifying Information

The content security policy headers found under the SysAdmin settings are the only ones that will not cause problems for MOVEit. Please see the documentation below for more information:

System - HTTP Security Headers
https://docs.progress.com/bundle/moveit-transfer-web-admin-help/page/System-HTTP-Security-Headers.html

When this error is encountered, remove any other content security policy headers that were applied to the server. If necessary, add the headers through MOVEit to maintain security.

Error Message

Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-GqaWV6iPg8RlSVmna7eID3XieSZ6V1ESXioyGzIma0U='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback. Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

Defect Number

Enhancement Number

Cause

The issue is the content security policy in the web.config file and it is because it is not allowing certiain parts like images scripts and other sources

Resolution

You need to find and make a copy of the web.config file from x:\moveittrasnfer\wwwroot directory and stop IIS. Once complete edit the web.config file and find the following section:

<httpProtocol>
<customHeaders>
<add name="Strict-Transport-Security" value="max-age=63072000; includeSubDomains" />
<add name="X-Content-Type-Options" value="nosniff" /> <add name="Content-Security-Policy" value="default-src 'self'" />
<add name="X-Frame-Options" value="DENY" />
<add name="X-XSS-Protection" value="1; mode=block" />
</customHeaders>
</httpProtocol>

The content security policy needs to be edited to be like the following:

<httpProtocol>
<customHeaders>
<add name="Strict-Transport-Security" value="max-age=63072000; includeSubDomains" />
<add name="X-Content-Type-Options" value="nosniff" /> <add name="Content-Security-Policy" value="default-src 'none''unsafe-inline' 'unsafe-hashes' object-src 'self' img-src'self' script-src 'self' style-src 'self'" />
<add name="X-Frame-Options" value="DENY" />
<add name="X-XSS-Protection" value="1; mode=block" />
</customHeaders>
</httpProtocol>

2. In another case, issue was resolved by removing Content-Security-Policy from IIS>HTTP Response headers.

Open IIS
Click on server name
Open HTTP Response Headers from the middle pane
If present, right click on "Content-Security-Policy" and choose remove
Reset IIS.

The above are examples which works however we highly recommend consulting with your security team to implement, a good reference and guide to content security policies can be found here:
https://content-security-policy.com/

Workaround

Notes

Keyword Phrase

Content-security-policy, web page, format, layout, displaying

Last Modified Date

6/1/2026 9:28 PM

MOVEit Application site Layout not loading properly in Edge and Chrome browsers

Files(0)

Was this article helpful?

Was this article helpful?

MOVEit Application site Layout not loading properly in Edge and Chrome browsers

Information

Related Articles