Content Security Policy (CSP)
If your website uses a Content Security Policy (CSP), you need to allow the sources the Contentsquare tag relies on so it can collect data.
The required directives are broken down by product. Each section shows the full CSP policy for that product, building on the Experience Analytics base policy and highlighting the directives specific to it.
Prefer to build your policy automatically? Jump to the CSP policy generator at the bottom of this page — pick the features you use (or paste your current policy) and copy the exact CSP.
Experience Analytics
Section titled Experience AnalyticsBase policy
Section titled Base policyBase policy directives are the foundation of your Contentsquare setup. They allow the core tag to install and load, and they enable essential features such as data collection, Session Replay, and Static Asset Management:
Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com; img-src *.contentsquare.net; connect-src *.contentsquare.net *.contentsquare.com; style-src app.contentsquare.com| Directive | What it allows | What breaks without it |
|---|---|---|
script-src *.contentsquare.net | Loading the Contentsquare tag and the additional Contentsquare-hosted scripts it bootstraps at runtime (for example the Voice of Customer widget) | The tag does not load — nothing is collected |
script-src 'unsafe-inline' | Running the inline installation snippet and any custom implementation code you add in a <script> block (for example to trigger artificial pageviews, set custom variables, or push events) | The install snippet and your inline implementation code are blocked — the tag does not initialize |
img-src *.contentsquare.net | Sending collected data through pixel (image) requests | Collected data is not sent to Contentsquare |
connect-src *.contentsquare.net *.contentsquare.com | Sending data through XMLHttpRequest/fetch, plus tag verification (*.contentsquare.com) | Data is not sent, and tag verification fails |
script-src app.contentsquare.com; style-src app.contentsquare.com | Loading the tag bundle Contentsquare injects when your site is opened inside the Contentsquare app (for example to build a zoning or screenshot) | Contentsquare users cannot build a zoning or screenshot from the app |
Why script-src 'unsafe-inline' is required
Section titled Why script-src 'unsafe-inline' is requiredThe 'unsafe-inline' directive is included in our base policy to accommodate how the tag is integrated into your website, rather than how it operates at runtime. The Contentsquare tag itself does not inject inline scripts or use inline event handlers. Instead, the requirement typically stems from two integration points:
- Installation snippet: when the tag is added directly to your HTML as an inline
<script>block. - Custom implementation code: when inline scripts handle custom events, trigger artificial pageviews, or set custom variables.
Removing 'unsafe-inline' for strict CSPs
Section titled Removing 'unsafe-inline' for strict CSPsIf your organization enforces a strict CSP and wants to remove 'unsafe-inline', either move the Contentsquare tag installation snippet and related implementation code to an external file or secure them with a CSP nonce.
Because the best approach depends on your own website architecture and deployment tools, configuring it falls outside the scope of this documentation. You should review your site's deployment workflow with your engineering team to determine the best path forward.
Implementing cross-domain tracking does not introduce an 'unsafe-inline' requirement. Because the cross-domain iframe operates as a separate origin, it is governed by its own standalone security policy.
To enable this feature, add the frame-src directive pointing to csxd.<domain>.
Optional features
Section titled Optional featuresAdd these directives only if you use the corresponding feature:
| Feature | Add to your CSP | What breaks without it |
|---|---|---|
| Cross-domain tracking | frame-src csxd.<domain> — one entry per cross-domain host, for example frame-src csxd.domain1.com csxd.domain2.com. If you use the single Contentsquare-hosted iframe, add frame-src csxd.contentsquare.net instead. | Sessions are not linked across your domains |
Voice of Customer
Section titled Voice of CustomerVoice of Customer includes the base policy and style-src 'unsafe-inline':
Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com; img-src *.contentsquare.net; connect-src *.contentsquare.net *.contentsquare.com; style-src app.contentsquare.com 'unsafe-inline'| Directive | What it allows | What breaks without it |
|---|---|---|
style-src 'unsafe-inline' | Voice of Customer applies styles inline when rendering a survey | Surveys render without their styling |
Product Analytics
Section titled Product AnalyticsProduct Analytics introduces two integration components:
- Heap SDK (
heap.js): loaded on your pages by the Contentsquare tag when your project is configured to also load Heap, and served from*.heap-api.com. If your project is not configured to load the Heap SDK, these hosts are not required. - Visual Labeler: loaded only when your site is opened inside the Contentsquare app for event tagging, and served from
heapanalytics.com.
The Product Analytics policy includes the base policy and the following directive:
'unsafe-eval': required only by the Visual Labeler for in-app event tagging — never by the core tag, and never for end-visitor data collection. It applies only while a Contentsquare user has your site open in the app.
Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com 'unsafe-eval' https://cdn.us.heap-api.com https://heapanalytics.com; img-src *.contentsquare.net https://heapanalytics.com; connect-src *.contentsquare.net *.contentsquare.com https://c.us.heap-api.com https://heapanalytics.com; style-src app.contentsquare.com https://heapanalytics.com; font-src https://heapanalytics.com| Directive | What it allows | What breaks without it |
|---|---|---|
script-src https://cdn.us.heap-api.com | Loading the Heap configuration script heap_config.js and the Heap SDK script heap.js | The Heap SDK does not load |
script-src https://heapanalytics.com | Loading the Visual Labeler script | The Visual Labeler does not load |
script-src 'unsafe-eval' | Visual Labeler rendering | The Visual Labeler fails to render |
img-src https://heapanalytics.com | Loading the Visual Labeler image assets | Visual Labeler image assets do not load |
connect-src https://c.us.heap-api.com | Sending events through the Heap SDK | Heap SDK events are not sent |
connect-src https://heapanalytics.com | Fetching environment settings for the Visual Labeler | The Visual Labeler cannot fetch environment settings |
style-src https://heapanalytics.com | Loading the Visual Labeler stylesheets | The Visual Labeler renders without its styling |
font-src https://heapanalytics.com | Loading the Visual Labeler custom fonts | The Visual Labeler falls back to default fonts |
Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com 'unsafe-eval' https://cdn.eu.heap-api.com https://cdn.us.heap-api.com https://heapanalytics.com https://eu.heapanalytics.com; img-src *.contentsquare.net https://heapanalytics.com https://eu.heapanalytics.com; connect-src *.contentsquare.net *.contentsquare.com https://c.eu.heap-api.com https://heapanalytics.com https://eu.heapanalytics.com; style-src app.contentsquare.com https://heapanalytics.com https://eu.heapanalytics.com; font-src https://heapanalytics.com https://eu.heapanalytics.com| Directive | What it allows | What breaks without it |
|---|---|---|
script-src https://cdn.eu.heap-api.com | Loading the Heap configuration script heap_config.js and the Heap SDK script heap.js | The Heap SDK does not load |
script-src https://cdn.us.heap-api.com | Fallback host for heap_config.js, kept for tag versions released before this region-aware routing | No impact on the current tag version. A project pinned to an older tag version fails to load the Heap SDK |
script-src https://heapanalytics.com https://eu.heapanalytics.com | Loading the Visual Labeler script | The Visual Labeler does not load |
script-src 'unsafe-eval' | Visual Labeler rendering | The Visual Labeler fails to render |
img-src https://heapanalytics.com https://eu.heapanalytics.com | Loading the Visual Labeler image assets | Visual Labeler image assets do not load |
connect-src https://c.eu.heap-api.com | Sending events through the Heap SDK | Heap SDK events are not sent |
connect-src https://heapanalytics.com https://eu.heapanalytics.com | Fetching environment settings for the Visual Labeler | The Visual Labeler cannot fetch environment settings |
style-src https://heapanalytics.com https://eu.heapanalytics.com | Loading the Visual Labeler stylesheets | The Visual Labeler renders without its styling |
font-src https://heapanalytics.com https://eu.heapanalytics.com | Loading the Visual Labeler custom fonts | The Visual Labeler falls back to default fonts |
CSP policy generator
Section titled CSP policy generatorSelect the features you use to generate the exact policy, or paste your current CSP to get it merged with the directives Contentsquare requires. The Experience Analytics base policy is always included.
Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com; img-src *.contentsquare.net; connect-src *.contentsquare.net *.contentsquare.com; style-src app.contentsquare.com