---
title: Content Security Policy (CSP) - Web
description: List of directives, values, and domains required by the Tag
source_url:
  html: https://docs.contentsquare.com/en/web/content-security-policy/
  md: https://docs.contentsquare.com/en/web/content-security-policy/index.md
---

> ## Documentation index
> Fetch the complete documentation index at: https://docs.contentsquare.com/llms.txt
> Use this file to discover all available pages before exploring further.

If your website uses a Content Security Policy (CSP), allow the sources the Contentsquare tag relies on so it can collect data.

The required directives are broken down by product. Each section shows the full CSP policy for each product, extending the Experience Analytics base policy and highlighting directives unique to each product.

Prefer to build your policy automatically? [Jump to the CSP policy generator](https://docs.contentsquare.com/en/web/content-security-policy/#csp-policy-generator) at the bottom of this page — pick the features you use (or paste your current policy) and copy the exact CSP.

## Experience Analytics

### Base policy

Base policy directives are the foundation of your Contentsquare setup. They allow the core tag to install and load safely, and essential features such as data collection and Session Replay:

```http
Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com; connect-src *.contentsquare.net *.contentsquare.com; style-src app.contentsquare.com
```

Wildcards

The base policy uses the `*.contentsquare.net` and `*.contentsquare.com` wildcards. This covers all subdomains for features like Zoning, Session Replay, and Static Asset Management, while ensuring future compatibility if Contentsquare adds subdomains later. All are Contentsquare-controlled domains.

If your security policy restricts wildcards, contact your Contentsquare representative for a project-specific host list based on your tag configuration.

| Directive | What it allows | What breaks without it |
| - | - | - |
| `script-src *.contentsquare.net` | Loading the Contentsquare tag and the additional Contentsquare-hosted scripts it bootstraps at runtime (for example the Voice of Customer widget) | The tag does not load — nothing is collected |
| `script-src 'unsafe-inline'` | Running the inline installation snippet and any custom implementation code you add in a `<script>` block (for example to trigger artificial pageviews, set custom variables, or push events) | The install snippet and your inline implementation code are blocked — the tag does not initialize |
| `connect-src *.contentsquare.net *.contentsquare.com` | Sending data through `XMLHttpRequest`/`fetch`, plus tag verification (`*.contentsquare.com`) | Data is not sent, and tag verification fails |
| `script-src app.contentsquare.com; style-src app.contentsquare.com` | Loading the tag bundle Contentsquare injects when your site is opened inside the Contentsquare app (for example to build a zoning or screenshot) | Contentsquare users cannot build a zoning or screenshot from the app |

### Why `script-src 'unsafe-inline'` is required

The `'unsafe-inline'` directive is included in our base policy to accommodate how the tag is integrated into your website, rather than how it operates at runtime. The Contentsquare tag itself does not inject inline scripts or use inline event handlers. Instead, the requirement typically stems from two integration points:

* **Installation snippet:** When the tag is added directly to your HTML as an inline `<script>` block.
* **Custom implementation code:** When inline scripts handle custom events, trigger artificial pageviews, or set custom variables.

#### Removing `'unsafe-inline'` for strict CSPs

If your organization enforces a strict CSP and wants to remove `'unsafe-inline'`, either move the Contentsquare tag installation snippet and related implementation code to an external file or secure them with a CSP nonce.

Because the best approach depends on your own website architecture and deployment tools, configuring it falls outside the scope of this documentation. You should review your site's deployment workflow with your engineering team to determine the best path forward.

Implementing cross-domain tracking does not introduce an `'unsafe-inline'` requirement. Because the cross-domain iframe operates as a separate origin, it is governed by its own standalone security policy.

To enable this feature, add the `frame-src` directive pointing to `csxd.<domain>`.

### Optional features

Add these directives **only if you use the corresponding feature**:

| Feature | Add to your CSP | What breaks without it |
| - | - | - |
| Cross-domain tracking | `frame-src csxd.<domain>` — one entry per cross-domain host, for example `frame-src csxd.domain1.com csxd.domain2.com`. If you use the single Contentsquare-hosted iframe, add `frame-src csxd.contentsquare.net` instead. | Sessions are not linked across your domains |

## Voice of Customer

Voice of Customer includes the base policy and `style-src 'unsafe-inline'`:

```http
Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com; connect-src *.contentsquare.net *.contentsquare.com; style-src app.contentsquare.com 'unsafe-inline'
```

| Directive | What it allows | What breaks without it |
| - | - | - |
| `style-src 'unsafe-inline'` | Voice of Customer applies styles inline when rendering a survey | Surveys render without their styling |

## Product Analytics

Product Analytics introduces two integration components:

* The **Heap SDK** (`heap.js`): Loaded on your pages by the Contentsquare tag when your project is configured to also load Heap, and served from `*.heap-api.com`. If your project is not configured to load the Heap SDK, these hosts are not required.
* The **Visual Labeler**: Loaded only when your site is opened inside the Contentsquare app for event tagging, and served from `heapanalytics.com`.

The Product Analytics policy includes the base policy and the following directive:

* **`'unsafe-eval'`:** Required only by the Visual Labeler for in-app event tagging — never by the core tag, and never for end-visitor data collection. It applies only while a Contentsquare user has your site open in the app.

Legacy SDK version

If your project still loads Heap SDK v4 instead of the current v5, also allow `script-src https://cdn.heapanalytics.com` for the SDK script. Heap SDK v4 sends events to `https://heapanalytics.com/h`, already covered by the following `connect-src https://heapanalytics.com` directive.

* US

  ```http
  Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com 'unsafe-eval' https://cdn.us.heap-api.com https://heapanalytics.com; img-src https://heapanalytics.com; connect-src *.contentsquare.net *.contentsquare.com https://c.us.heap-api.com https://heapanalytics.com; style-src app.contentsquare.com https://heapanalytics.com; font-src https://heapanalytics.com
  ```

  | Directive | What it allows | What breaks without it |
  | - | - | - |
  | `script-src https://cdn.us.heap-api.com` | Loading the Heap configuration script `heap_config.js` and the Heap SDK script `heap.js` | The Heap SDK does not load |
  | `script-src https://heapanalytics.com` | Loading the Visual Labeler script | The Visual Labeler does not load |
  | `script-src 'unsafe-eval'` | Visual Labeler rendering | The Visual Labeler fails to render |
  | `img-src https://heapanalytics.com` | Loading the Visual Labeler image assets | Visual Labeler image assets do not load |
  | `connect-src https://c.us.heap-api.com` | Sending events through the Heap SDK | Heap SDK events are not sent |
  | `connect-src https://heapanalytics.com` | Fetching environment settings for the Visual Labeler | The Visual Labeler cannot fetch environment settings |
  | `style-src https://heapanalytics.com` | Loading the Visual Labeler stylesheets | The Visual Labeler renders without its styling |
  | `font-src https://heapanalytics.com` | Loading the Visual Labeler custom fonts | The Visual Labeler falls back to default fonts |

* EU

  ```http
  Content-Security-Policy: script-src 'unsafe-inline' *.contentsquare.net app.contentsquare.com 'unsafe-eval' https://cdn.eu.heap-api.com https://cdn.us.heap-api.com https://heapanalytics.com https://eu.heapanalytics.com; img-src https://heapanalytics.com https://eu.heapanalytics.com; connect-src *.contentsquare.net *.contentsquare.com https://c.eu.heap-api.com https://heapanalytics.com https://eu.heapanalytics.com; style-src app.contentsquare.com https://heapanalytics.com https://eu.heapanalytics.com; font-src https://heapanalytics.com https://eu.heapanalytics.com
  ```

  | Directive | What it allows | What breaks without it |
  | - | - | - |
  | `script-src https://cdn.eu.heap-api.com` | Loading the Heap configuration script `heap_config.js` and the Heap SDK script `heap.js` | The Heap SDK does not load |
  | `script-src https://cdn.us.heap-api.com` | Fallback host for `heap_config.js`, kept for tag versions released before this region-aware routing | No impact on the current tag version. A project pinned to an older tag version fails to load the Heap SDK |
  | `script-src https://heapanalytics.com https://eu.heapanalytics.com` | Loading the Visual Labeler script | The Visual Labeler does not load |
  | `script-src 'unsafe-eval'` | Visual Labeler rendering | The Visual Labeler fails to render |
  | `img-src https://heapanalytics.com https://eu.heapanalytics.com` | Loading the Visual Labeler image assets | Visual Labeler image assets do not load |
  | `connect-src https://c.eu.heap-api.com` | Sending events through the Heap SDK | Heap SDK events are not sent |
  | `connect-src https://heapanalytics.com https://eu.heapanalytics.com` | Fetching environment settings for the Visual Labeler | The Visual Labeler cannot fetch environment settings |
  | `style-src https://heapanalytics.com https://eu.heapanalytics.com` | Loading the Visual Labeler stylesheets | The Visual Labeler renders without its styling |
  | `font-src https://heapanalytics.com https://eu.heapanalytics.com` | Loading the Visual Labeler custom fonts | The Visual Labeler falls back to default fonts |

## CSP policy generator

Select the features you use to generate the exact policy, or paste your current CSP to get it merged with the directives Contentsquare requires. The Experience Analytics base policy is always included.


```json
{"@context":"https://schema.org","@type":"TechArticle","headline":"Content Security Policy (CSP)","description":"List of directives, values, and domains required by the Tag","url":"https://docs.contentsquare.com/en/web/content-security-policy/","inLanguage":"en","dateModified":"2026-10-14T16:46:02+02:00","publisher":{"@type":"Organization","name":"Contentsquare","url":"https://www.contentsquare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://docs.contentsquare.com/#website","name":"Contentsquare Technical Documentation","url":"https://docs.contentsquare.com/"}}
```