{"id":105136,"date":"2025-02-23T11:52:14","date_gmt":"2025-02-23T11:52:14","guid":{"rendered":"https:\/\/peraltafinancing.com\/analytics\/gtmtips-google-tag-manager-content-security-policy\/"},"modified":"2025-02-23T11:52:14","modified_gmt":"2025-02-23T11:52:14","slug":"gtmtips-google-tag-manager-content-security-policy","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=105136","title":{"rendered":"#GTMTips: Google Tag Manager Content Security Policy"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p>A <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/CSP\">Content Security Policy (CSP)<\/a> is something you\u2019ll configure your web server with to add an additional layer of protection, especially from harmful scripts loaded from third-party vendors. Once you have a CSP in place, all resources loaded and executed by the web page need to pass the CSP directives. For <a href=\"https:\/\/tagmanager.google.com\/\">Google Tag Manager<\/a>, this is very relevant. <strong>If you have a CSP in place, you will need to modify it so that Google Tag Manager functions properly<\/strong>.<\/p>\n<p>In this short article, I\u2019ll show you what directives you\u2019ll need in place for GTM to work. In addition to the instructions here, I want you to read the excellent Bounteous article on the <a href=\"https:\/\/www.bounteous.com\/insights\/2017\/07\/20\/using-google-analytics-google-tag-manager-content-security-policy\/\">same topic<\/a>. It isn\u2019t comprehensive enough when it comes to GTM (which is why I wrote this article), but it has more information on CSPs in general, and it has instructions on how to get your <strong>tags<\/strong> to comply with the CSP as well.<\/p>\n<p>                <span class=\"simmer\"><br \/>\n  <span class=\"close\">X<\/span><\/p>\n<p>\n    <span class=\"fa fa-md fa-bell\"\/><br \/>\n    <strong>The Simmer Newsletter<\/strong>\n  <\/p>\n<p>\n    Subscribe to the <a href=\"https:\/\/www.simoahava.com\/newsletter\/\">Simmer newsletter<\/a> to get the latest news and content from Simo Ahava into your email inbox!\n  <\/p>\n<p>  <\/span><\/p>\n<h2 id=\"tip-81-google-tag-manager-content-security-policy\">Tip 81: Google Tag Manager Content Security Policy<\/h2>\n<div style=\"aspect-ratio: 960 \/ 540;\" class=\"figure nocaption\">\n<p>    <a href=\"https:\/\/www.simoahava.com\/images\/2018\/07\/google-tag-manager-content-security-policy.jpg\" title=\"Google Tag Manager Content Security Policy\"><\/p>\n<p>    <img decoding=\"async\" class=\"fig-img\" height=\"540\" width=\"960\" loading=\"lazy\" src=\"https:\/\/www.simoahava.com\/images\/2018\/07\/google-tag-manager-content-security-policy.jpg#ZgotmplZ\" alt=\"Google Tag Manager Content Security Policy\"\/><\/p>\n<p>    <\/a><\/p>\n<\/div>\n<p>First, here are a number of <strong>symptoms<\/strong> to look for, which might help you detect that you have a CSP issue:<\/p>\n<ul>\n<li>\n<p>No debug panel shown even if you are in Preview mode.<\/p>\n<\/li>\n<li>\n<p>Debug panel shows, but it has no styles (see the image above).<\/p>\n<\/li>\n<li>\n<p>Google Tag Manager doesn\u2019t load, and you see a Content Security Policy error in the JavaScript console.<\/p>\n<\/li>\n<\/ul>\n<div style=\"aspect-ratio: 1908 \/ 72;\" class=\"figure nocaption\">\n<p>    <a href=\"https:\/\/www.simoahava.com\/images\/2018\/07\/csp-error.jpg\" title=\"CSP error\"><\/p>\n<p>    <img decoding=\"async\" class=\"fig-img\" height=\"72\" width=\"1908\" loading=\"lazy\" src=\"https:\/\/www.simoahava.com\/images\/2018\/07\/csp-error.jpg#ZgotmplZ\" alt=\"CSP error\"\/><\/p>\n<p>    <\/a><\/p>\n<\/div>\n<p>Google Tag Manager requires you to allow a number of things: inline scripts, inline <code>eval()<\/code> use, and inline styles. Listed below are the <strong>modifications<\/strong> you need to make in the Content Security Policy, so that Google Tag Manager works properly both in published containers <strong>and<\/strong> in Preview mode.<\/p>\n<blockquote>\n<p>Thanks to <strong>Wieland Lindenthal<\/strong> for the feedback that helped make the directives below more precise.<\/p>\n<\/blockquote>\n<table>\n<thead>\n<tr>\n<th>Directive<\/th>\n<th>Comment<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>script-src 'unsafe-eval' 'unsafe-inline' https:\/\/tagmanager.google.com\/ https:\/\/www.googletagmanager.com\/<\/code><\/td>\n<td>You need to enable the two listed domains in <code>script-src<\/code> together with the <code>'unsafe-inline'<\/code> and <code>'unsafe-eval'<\/code> sources. GTM requires both inline script and <code>eval()<\/code> to run custom code added by users.<\/td>\n<\/tr>\n<tr>\n<td><code>style-src 'unsafe-inline' https:\/\/tagmanager.google.com\/ https:\/\/fonts.googleapis.com\/<\/code><\/td>\n<td>This directive enables the styles and custom fonts in the GTM debug panel.<\/td>\n<\/tr>\n<tr>\n<td><code>img-src 'unsafe-inline' https:\/\/ssl.gstatic.com\/<\/code><\/td>\n<td>This directive loads the Google Tag Manager logo image in debug mode.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The first directive is absolutely necessary, the last two directives are useful but not critical. However, I do recommend including the <code>style-src<\/code> directive, since it\u2019s a pain to work in debug mode without the stylesheet.<\/p>\n<h2 id=\"summary\">Summary<\/h2>\n<p>These simple instructions should help you fix your site\u2019s CSP so that Google Tag Manager works properly.<\/p>\n<p>I know you might be wary of adding all these directives, especially since they might introduce issues into your site by being so relaxed. However, Google Tag Manager <strong>is<\/strong> a script injector, so it does require elevated privileges to work properly on your site. It\u2019s part of the bargain when using a tag management solution.<\/p>\n<\/p><\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>A Content Security Policy (CSP) is something you\u2019ll configure your web server with to add an additional layer of protection, especially from harmful scripts loaded from third-party vendors. Once you have a CSP in place, all resources loaded and executed by the web page need to pass the CSP directives. For Google Tag Manager, this [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":105137,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12033],"tags":[7222,1531,14492,14495,11572,2764,1791],"dealstore":[],"offerexpiration":[],"class_list":["post-105136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics","tag-content","tag-google","tag-gtmtips","tag-manager","tag-policy","tag-security","tag-tag"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>#GTMTips: Google Tag Manager Content Security Policy - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=105136\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"#GTMTips: Google Tag Manager Content Security Policy - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"A Content Security Policy (CSP) is something you\u2019ll configure your web server with to add an additional layer of protection, especially from harmful scripts loaded from third-party vendors. Once you have a CSP in place, all resources loaded and executed by the web page need to pass the CSP directives. For Google Tag Manager, this [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=105136\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2025-02-23T11:52:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"540\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=105136#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=105136\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"#GTMTips: Google Tag Manager Content Security Policy\",\"datePublished\":\"2025-02-23T11:52:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=105136\"},\"wordCount\":487,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=105136#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg\",\"keywords\":[\"Content\",\"Google\",\"GTMTips\",\"Manager\",\"Policy\",\"Security\",\"TAG\"],\"articleSection\":[\"Analytics\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=105136#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=105136\",\"url\":\"https:\/\/fivemor.com\/?p=105136\",\"name\":\"#GTMTips: Google Tag Manager Content Security Policy - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=105136#primaryimage\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=105136#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg\",\"datePublished\":\"2025-02-23T11:52:14+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=105136#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=105136\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/?p=105136#primaryimage\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg\",\"width\":960,\"height\":540},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=105136#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#GTMTips: Google Tag Manager Content Security Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"#GTMTips: Google Tag Manager Content Security Policy - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=105136","og_locale":"en_US","og_type":"article","og_title":"#GTMTips: Google Tag Manager Content Security Policy - Som2ny Network","og_description":"A Content Security Policy (CSP) is something you\u2019ll configure your web server with to add an additional layer of protection, especially from harmful scripts loaded from third-party vendors. Once you have a CSP in place, all resources loaded and executed by the web page need to pass the CSP directives. For Google Tag Manager, this [&hellip;]","og_url":"https:\/\/fivemor.com\/?p=105136","og_site_name":"Som2ny Network","article_published_time":"2025-02-23T11:52:14+00:00","og_image":[{"width":960,"height":540,"url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=105136#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=105136"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"#GTMTips: Google Tag Manager Content Security Policy","datePublished":"2025-02-23T11:52:14+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=105136"},"wordCount":487,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"image":{"@id":"https:\/\/fivemor.com\/?p=105136#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg","keywords":["Content","Google","GTMTips","Manager","Policy","Security","TAG"],"articleSection":["Analytics"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=105136#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=105136","url":"https:\/\/fivemor.com\/?p=105136","name":"#GTMTips: Google Tag Manager Content Security Policy - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fivemor.com\/?p=105136#primaryimage"},"image":{"@id":"https:\/\/fivemor.com\/?p=105136#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg","datePublished":"2025-02-23T11:52:14+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=105136#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=105136"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/?p=105136#primaryimage","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/google-tag-manager-content-security-policy.jpg","width":960,"height":540},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=105136#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"#GTMTips: Google Tag Manager Content Security Policy"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/105136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=105136"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/105136\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/media\/105137"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=105136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=105136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=105136"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=105136"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=105136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}