Link a hosted game
Embedding and hosting requirements for an external game.
On this page
Public HTTPS URL
Use an external public HTTPS URL without credentials, IP literals or a nonstandard port. It must return successful HTML. Private/reserved networks, platform/play origins and unsafe redirects are rejected. The checker follows at most four redirects and reads at most 2 MiB of HTML. Your host remains responsible for uptime, dependencies and TLS.
Embedding headers
Do not send X-Frame-Options: DENY or SAMEORIGIN. If you send CSP, every applicable frame-ancestors directive must permit the platform origin. Configure headers on the HTTP response; a meta tag cannot set frame-ancestors.
Content-Security-Policy: frame-ancestors https://zuqplay.com;For local testing, explicitly permit your local platform origin too. Changing your live host can affect a reviewed version immediately. Keep reviewed URLs stable and submit updates for review.
Wrapper and checks
The game runs in a sandboxed iframe with scripts, its own origin, pointer lock, fullscreen, gamepad and autoplay permissions. Do not rely on access to the parent DOM, unsandboxed popups, downloads or form submission. Integrate the SDK with postMessage. The check inspects current HTML only; test dependencies and actual gameplay manually.