# Fix: Contact form blocked by CSP (sol.aibitsoft.cloud)

The contact form was blocked because the page’s Content-Security-Policy `connect-src` did not allow `https://sol.aibitsoft.cloud`.

## Option A: Use the proxy (recommended, no CSP change)

A same-origin proxy is available so the form can stay within the allowed `connect-src` (e.g. `'self'`).

1. **Point the contact form to the proxy**

   In your frontend (e.g. `js/api-service.js` or wherever the contact API URL is set), change the contact endpoint from:

   - **From:** `https://sol.aibitsoft.cloud/api/contact`  
   - **To:** `https://aibitsoft.com/contact-proxy.php`  
     or (same origin) `/contact-proxy.php`

   Example: if you have something like:

   ```javascript
   const CONTACT_URL = 'https://sol.aibitsoft.cloud/api/contact';
   ```

   change it to:

   ```javascript
   const CONTACT_URL = '/contact-proxy.php';  // or 'https://aibitsoft.com/contact-proxy.php'
   ```

2. **No CSP or server config changes are required.** The browser only talks to your own domain; the server forwards the request to `https://sol.aibitsoft.cloud/api/contact`.

---

## Option B: Allow the API in CSP

If you prefer to keep calling the API directly, add `https://sol.aibitsoft.cloud` to the **same** place where the current CSP is defined.

The error shows this directive:

- `connect-src 'self' https://www.google.com https://cdn.jsdelivr.net`

So you need:

- `connect-src 'self' https://www.google.com https://cdn.jsdelivr.net https://sol.aibitsoft.cloud`

**Where to change it:**

1. **If the CSP is in a meta tag**  
   Open the HTML of the page that loads the contact form (e.g. the main template or layout). Find something like:

   ```html
   <meta http-equiv="Content-Security-Policy" content="... connect-src 'self' https://www.google.com https://cdn.jsdelivr.net ...">
   ```

   Add `https://sol.aibitsoft.cloud` inside the same `connect-src` list in that `content` attribute.

2. **If the CSP is set in the server (Apache / cPanel)**  
   In cPanel: **Domains** → **Domains** → **aibitsoft.com** → **Modify Headers** (or similar), or in the Apache vhost / include for aibitsoft.com, find the `Content-Security-Policy` (or `Header set Content-Security-Policy`) and add `https://sol.aibitsoft.cloud` to the `connect-src` part.

---

## Files in this repo

- **`/contact-proxy.php`** – Proxy script: accepts POST and forwards to `https://sol.aibitsoft.cloud/api/contact`.
- **`/.htaccess`** – Already includes a full CSP with `https://sol.aibitsoft.cloud` in `connect-src`. If the blocking CSP is coming from a meta tag or another server config, that other source must be updated (Option B) or you must use the proxy (Option A).