A Web Embed is blank or a website/login does not work inside it

What you may be seeing

• A Web Embed element is blank, shows a browser refusal, or a login/session-based site behaves differently from opening it normally in a browser tab.

What usually causes it

• The remote website sends X-Frame-Options or CSP frame-ancestors rules that refuse third-party embedding.
• CanvasRelay intentionally renders Web Embed with a sandbox that allows scripts but not same-origin privileges; cookies/storage/top-navigation behavior is therefore restricted.
• The widget is online-only and hides/degrades when its external site is unreachable.
• Web Embed is not supported on Roku at all because the native Roku player has no browser runtime.

Do this

1. First test whether the target site permits being framed by another origin. If the site itself blocks framing, CanvasRelay cannot safely override that policy.
2. Do not rely on an embedded page that requires normal third-party cookies, persistent login storage, or unrestricted top navigation; the CanvasRelay iframe is deliberately sandboxed.
3. For signage you control, prefer uploaded CanvasRelay media/widgets or a page specifically designed to be safely embeddable.
4. On Roku, replace Web Embed with a supported native/snapshot/uploaded-content alternative rather than troubleshooting iframe settings.

You know it is fixed when

• An embeddable public page renders in browser/Pi players without requiring prohibited sandbox capabilities.