Index: src/server.js
===================================================================
--- src/server.js	(revision a1c8cb8e3249d5b67ffce6bdd2c3ca39542ef663)
+++ src/server.js	(revision 3e86f1cca344a75facd291ef34a6bf56445bf532)
@@ -65,5 +65,15 @@
     directives: {
       defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-inline'"],
+      scriptSrc: [
+        "'self'",
+        "'unsafe-inline'",
+        // Eigen custom-embeds (embed-player.js) laden de OFFICIELE player-API's
+        // van deze hosts. Zonder deze whitelist blokkeert de CSP ze stil (alleen
+        // een console-fout) en faalt de embed-speler.
+        "https://www.youtube.com",   // YouTube IFrame Player API (+ www-widgetapi.js)
+        "https://s.ytimg.com",       // YouTube player-assets
+        "https://w.soundcloud.com",  // SoundCloud Widget API (api.js)
+        "https://open.spotify.com",  // Spotify iFrame API
+      ],
       // Helmet's default zet script-src-attr op 'none', wat ALLE inline event-
       // handlers (onchange/onclick/onsubmit) blokkeert — daardoor deed o.a. de
@@ -88,4 +98,5 @@
         "https://embed.music.apple.com",
         "https://www.youtube-nocookie.com",
+        "https://www.youtube.com",   // YouTube IFrame API maakt soms een www.youtube.com-iframe
         "https://player.vimeo.com",
       ],