# Troubleshoot Wicket
> What each Wicket widget message means, and what to do when the widget is missing, a token is refused, test keys reach production or a visitor cannot pass.
Source: https://www.coritan.com/docs/wicket/troubleshooting/
The widget's **Help** link opens this page. Start with what you see, find it below, and follow the fix. The browser's console says more than the widget does: open it with F12 and look for lines that start with `Wicket:`.
## The widget does not appear
The page shows an empty space where the widget should be, or no widget at all. Work down the list.
### The page's hostname is not on the widget's list {#hostname-not-listed}
Our host then tells the browser to refuse the frame, so the widget cannot show a message of its own. The console shows `Framing 'https://wicket.coritan.com/' violates the following Content Security Policy directive: "frame-ancestors ..."`, and after ten seconds a line that starts `Wicket: the frame for site key ... has not loaded`. Add the page's hostname to the widget's hostnames. A hostname covers every name under it, so `example.com` covers `www.example.com`, and `www.example.com` does not cover `example.com`. A page on `localhost` is never covered: use a [test key](/docs/wicket/test-keys/) there.
### Your page's Content-Security-Policy blocks the script or the frame
The console shows `Refused to load the script` or `Refused to frame`. Add Wicket's address to `script-src` and `frame-src`:
```text
script-src https://wicket.coritan.com;
frame-src https://wicket.coritan.com;
```
If your policy sets `default-src` and no `frame-src`, name the address in `default-src` or add a `frame-src`. [Add Wicket to your site](/docs/wicket/add-wicket-to-your-site/#allow-wicket-in-a-content-security-policy) has the details.
### The page is open as a file
A page you open from your disk, with an address that starts `file://`, has no http or https address, so Wicket cannot tell which site is asking and does not run the check, even with a test key. The console shows this warning:
```text
Wicket: this page has no http or https address (it is open as a file, for example), so the Wicket host will not show the widget here. Serve it from your site, or from localhost with a test key.
```
Serve the page from a local web server, so that its address starts `http://localhost`, and use a [test key](/docs/wicket/test-keys/). A real widget cannot list `localhost` ([Hostnames](/docs/wicket/#hostnames)).
### The script did not run
Check that the script tag's address is `https://wicket.coritan.com/v1/api.js`, that the browser's network panel shows it loaded, and that an ad or privacy blocker is not removing it. With `?render=explicit` in the address, nothing is drawn until your code calls `wicket.render()`.
### The container is wrong
The container needs the class `wicket-widget` for implicit rendering, and a `data-sitekey`. Without a site key the console says `the widget has no site key`.
### The widget is invisible, or its appearance is `interaction-only`
These draw nothing until they must ([Widget modes](/docs/wicket/widget-modes/)). Use a [test key](/docs/wicket/test-keys/) that shows a box, such as `wk_test_interactive`, to see a visible widget.
## The widget says This site's check is not set up for this page {#site-not-set-up}
The widget shows a warning, the line above, and a code in small type. The code says which of three problems it is. The console names the site key and what to fix.
`unknown_sitekey`
: No widget has this site key, or the container has none. Copy the site key from the widget in the dashboard again. A key that starts `wks_` is a secret key, and a page must never hold one: the script refuses it and draws no widget.
`widget_disabled`
: Our team turned the widget off. The dashboard says why above the widget's tabs, and its **Contact support** button starts a conversation ([Contact support](/docs/support/conversations/)). A form that uses the widget stops passing checks until our team turns it back on.
`hostname_not_allowed`
: The page's hostname is not on the widget's list. Add it, as in [the first problem above](#the-widget-does-not-appear). The browser usually refuses the frame first, so you see an empty space and not this message.
## The widget says Could not reach Wicket
The warning shows **Could not reach Wicket. Check your connection** and a **Try again** button. The error code is `network`, `rate_limited` or `internal`, and the script starts the check again by itself every 8 seconds, up to five times, unless `retry` is `never`.
- For `network`, check the visitor's connection, and that no firewall, proxy or blocker stops requests to `wicket.coritan.com`.
- For `rate_limited`, the visitor's network started too many checks in a minute ([Wicket limits](/docs/wicket/limits/#rate-budgets)). It clears by itself. A test script that loads many widgets from one address meets it first.
- For `internal`, try again in a moment. If it keeps happening, [contact support](/docs/support/conversations/) with the time and the site key.
## The widget says We could not check this browser
The check refused the visitor: the error code is `failed`. Wicket refuses only on near-certain evidence, such as a browser that says a script is driving it, and the widget never says which. The visitor has a **Try again** button, and a link **Having trouble?** in the widget's footer.
If the visitor is a person, see [A visitor cannot pass](#a-visitor-cannot-pass). If you are testing, remember that a script, a headless browser or a test runner is what Wicket is built to refuse. Use a [test key](/docs/wicket/test-keys/) in tests, not a real widget.
## The widget says This browser cannot run the check
The error code is `unsupported`, and your `unsupported-callback` is called. The check needs three things in the visitor's browser: JavaScript, Web Workers and WebCrypto. The cause is usually one of these:
- The page is served over plain `http://`. A browser gives a frame WebCrypto only when the page that holds it is served over HTTPS, or from `localhost`. Serve the page over HTTPS.
- The browser is very old, or a privacy setting or an extension turns off Web Workers or WebCrypto. Ask the visitor to update the browser or to try another one.
The script writes the reason once for each widget as a console warning: `Wicket: this browser cannot run the check. It needs Web Workers and WebCrypto, and a page served over plain http (not localhost) does not get them. Serve the page over HTTPS.` Your `unsupported-callback` can return `true` to say you handled it, and the script then writes nothing ([Widget options](/docs/wicket/widget-options/#callbacks)).
## The widget says This check expired or Time ran out
A token works once and for 300 seconds. When it expires the widget shows **This check expired**, and with `refresh-expired` at `auto` it starts a new check at once, so the visitor usually sees it for a moment. A box that nobody ticks for 120 seconds shows **Time ran out**, and `refresh-timeout` decides whether the check starts again by itself or waits for a click on **Check again**.
If a visitor leaves a form open for a long time and then sends it, your server may meet an expired token. Read the next section.
## Your server says the token is not valid
The verify call answers `"success": false` with a code in `error-codes` ([Verify a token on your server](/docs/wicket/verify-tokens/)). What each code means in practice:
`missing-input-response`
: Your server got no token. The container must be inside the `