我们正试图从www.example.com在我们的网站上嵌入一个外部小部件pledge.to。我们在NGINX中使用这个指令代码：

add_header Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' 'pledge.to';" always;

但我们在控制台中收到错误消息：

The Content-Security-Policy directive 'default-src' contains 'frame-ancestors' as a source expression. Did you want to add it as a directive and forget a semicolon?

这怎么就错了呢？