Content Security Policy (CSP)

If your website uses a Content Security Policy (CSP), you need to allow the sources the Contentsquare tag relies on so it can collect data.

The required directives are broken down by product. Each section shows the full CSP policy for that product, building on the Experience Analytics base policy and highlighting the directives specific to it.

Experience Analytics

Base policy

Base policy directives are the foundation of your Contentsquare setup. They allow the core tag to install and load, and they enable essential features such as data collection, Session Replay, and Static Asset Management:

Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net; img-src *.contentsquare.net; connect-src *.contentsquare.net *.contentsquare.com

Directive	What it allows	What breaks without it
`script-src *.contentsquare.net`	Loading the Contentsquare tag and the additional Contentsquare-hosted scripts it bootstraps at runtime (for example the Voice of Customer widget)	The tag does not load — nothing is collected
`script-src 'unsafe-inline'`	Running the inline installation snippet and any custom implementation code you add in a `<script>` block (for example to trigger artificial pageviews, set custom variables, or push events)	The install snippet and your inline implementation code are blocked — the tag does not initialize
`img-src *.contentsquare.net`	Sending collected data through pixel (image) requests	Collected data is not sent to Contentsquare
`connect-src .contentsquare.net .contentsquare.com`	Sending data through `XMLHttpRequest`/`fetch`, plus tag verification (`*.contentsquare.com`)	Data is not sent, and tag verification fails

Why `script-src 'unsafe-inline'` is required

The 'unsafe-inline' directive is included in our base policy to accommodate how the tag is integrated into your website, rather than how it operates at runtime. The Contentsquare tag itself does not inject inline scripts or use inline event handlers. Instead, the requirement typically stems from two integration points:

Installation snippet: when the tag is added directly to your HTML as an inline <script> block.
Custom implementation code: when inline scripts handle custom events, trigger artificial pageviews, or set custom variables.

Removing `'unsafe-inline'` for strict CSPs

If your organization enforces a strict CSP and wants to remove 'unsafe-inline', either move the Contentsquare tag installation snippet and related implementation code to an external file or secure them with a CSP nonce.

Because the best approach depends on your own website architecture and deployment tools, configuring it falls outside the scope of this documentation. You should review your site's deployment workflow with your engineering team to determine the best path forward.

Implementing cross-domain tracking does not introduce an 'unsafe-inline' requirement. Because the cross-domain iframe operates as a separate origin, it is governed by its own standalone security policy.

To enable this feature, add the frame-src directive pointing to csxd.<domain>.

Optional features

Add these directives only if you use the corresponding feature:

Feature	Add to your CSP	What breaks without it
Cross-domain tracking	`frame-src csxd.<domain>` — one entry per cross-domain host, for example `frame-src csxd.domain1.com csxd.domain2.com`. If you use the single Contentsquare-hosted iframe, add `frame-src csxd.contentsquare.net` instead.	Sessions are not linked across your domains
Zoning / snapshot from the Contentsquare app	`script-src app.contentsquare.com`	Contentsquare users cannot build a zoning or snapshot from the app. No impact on end-visitor data collection.

Voice of Customer

Voice of Customer includes the base policy and style-src 'unsafe-inline':

Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net; img-src *.contentsquare.net; connect-src *.contentsquare.net *.contentsquare.com; style-src 'unsafe-inline'

Directive	What it allows	What breaks without it
`style-src 'unsafe-inline'`	Voice of Customer applies styles inline when rendering a survey	Surveys render without their styling

Product Analytics

Product Analytics introduces two integration components:

Heap SDK (heap.js): loaded on your pages by the Contentsquare tag when your project is configured to also load Heap, and served from *.heap-api.com. If your project is not configured to load the Heap SDK, these hosts are not required.
Visual Labeler: loaded only when your site is opened inside the Contentsquare app for event tagging, and served from heapanalytics.com.

The Product Analytics policy includes the base policy and the following directives:

'unsafe-eval': required only by the Visual Labeler for in-app event tagging — never by the core tag, and never for end-visitor data collection. It applies only while a Contentsquare user has your site open in the app.
app.contentsquare.com: the Visual Labeler runs inside the Contentsquare app, so the optional app.contentsquare.com directive also applies.

Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net 'unsafe-eval' https://cdn.us.heap-api.com https://heapanalytics.com; img-src *.contentsquare.net https://heapanalytics.com; connect-src *.contentsquare.net *.contentsquare.com https://c.us.heap-api.com https://heapanalytics.com; style-src https://heapanalytics.com; font-src https://heapanalytics.com

Directive	What it allows	What breaks without it
`script-src https://cdn.us.heap-api.com`	Loading the Heap configuration script `heap_config.js` and the Heap SDK script `heap.js`	The Heap SDK does not load
`script-src https://heapanalytics.com`	Loading the Visual Labeler script	The Visual Labeler does not load
`script-src 'unsafe-eval'`	Visual Labeler rendering	The Visual Labeler fails to render
`img-src https://heapanalytics.com`	Loading the Visual Labeler image assets	Visual Labeler image assets do not load
`connect-src https://c.us.heap-api.com`	Sending events through the Heap SDK	Heap SDK events are not sent
`connect-src https://heapanalytics.com`	Fetching environment settings for the Visual Labeler	The Visual Labeler cannot fetch environment settings
`style-src https://heapanalytics.com`	Loading the Visual Labeler stylesheets	The Visual Labeler renders without its styling
`font-src https://heapanalytics.com`	Loading the Visual Labeler custom fonts	The Visual Labeler falls back to default fonts

Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net 'unsafe-eval' https://cdn.eu.heap-api.com https://cdn.us.heap-api.com https://heapanalytics.com https://eu.heapanalytics.com; img-src *.contentsquare.net https://heapanalytics.com https://eu.heapanalytics.com; connect-src *.contentsquare.net *.contentsquare.com https://c.eu.heap-api.com https://heapanalytics.com https://eu.heapanalytics.com; style-src https://heapanalytics.com https://eu.heapanalytics.com; font-src https://heapanalytics.com https://eu.heapanalytics.com

Directive	What it allows	What breaks without it
`script-src https://cdn.eu.heap-api.com`	Loading the Heap SDK script `heap.js`	The Heap SDK does not load
`script-src https://cdn.us.heap-api.com`	Loading the Heap configuration script `heap_config.js`	The Heap SDK does not load
`script-src https://heapanalytics.com https://eu.heapanalytics.com`	Loading the Visual Labeler script	The Visual Labeler does not load
`script-src 'unsafe-eval'`	Visual Labeler rendering	The Visual Labeler fails to render
`img-src https://heapanalytics.com https://eu.heapanalytics.com`	Loading the Visual Labeler image assets	Visual Labeler image assets do not load
`connect-src https://c.eu.heap-api.com`	Sending events through the Heap SDK	Heap SDK events are not sent
`connect-src https://heapanalytics.com https://eu.heapanalytics.com`	Fetching environment settings for the Visual Labeler	The Visual Labeler cannot fetch environment settings
`style-src https://heapanalytics.com https://eu.heapanalytics.com`	Loading the Visual Labeler stylesheets	The Visual Labeler renders without its styling
`font-src https://heapanalytics.com https://eu.heapanalytics.com`	Loading the Visual Labeler custom fonts	The Visual Labeler falls back to default fonts