Content Security Policy for the tracker

The Content Security Policy directives the analytics tracker needs (script-src, connect-src and img-src), plus the setup for nonces.

# Content Security Policy for the tracker

> The Content Security Policy directives the analytics tracker needs (script-src, connect-src and img-src), plus the setup for nonces.

If your site sends a `Content-Security-Policy` header, allow the tracker's
script and its requests:

```http
Content-Security-Policy: script-src 'self' https://privatusstats.com; connect-src 'self' https://privatusstats.com
```

| Directive | Why |
|---|---|
| `script-src https://privatusstats.com` | Loads `pa.js` and any [modules](/docs/tracker/modules) (`pa.auto.js`, `pa.vitals.js`, `pa.clicks.js`) |
| `connect-src https://privatusstats.com` | Sends hits with `fetch`/`sendBeacon` to `/api/event` |

Add these to your existing directives and keep everything else you already
allow.

### Older snippets

Snippets made before the tracker had its own domain load `pa.js` from
`https://privatusanalytics.com`. They keep working, and the script now sends its hits
and loads its modules from `https://privatusstats.com`. Allow both:

```http
Content-Security-Policy: script-src 'self' https://privatusanalytics.com https://privatusstats.com; connect-src 'self' https://privatusstats.com
```

Or replace the snippet with the one on Site settings → Tracking, which
loads from `https://privatusstats.com`, and allow only that.

## The queue stub and nonces

The [queue stub](/docs/tracker/javascript-api#queue-stub) is an inline
script. With a strict CSP, give it your page's nonce
(`<script nonce="…">`) or move it into a file you serve.

## Symptoms of a CSP block

In the console: *Refused to load the script…* (missing `script-src`) or
*Refused to connect to…* (missing `connect-src`). The **Verify
installation** check on Site settings → Tracking reads the
`Content-Security-Policy` header of the page it fetches and tells you
whether `script-src` and `connect-src` (or `default-src`, when those are
absent) allow `privatusstats.com`. See
[CSP errors](/docs/troubleshooting/csp).

View as Markdown

If your site sends a Content-Security-Policy header, allow the tracker's script and its requests:

http

Content-Security-Policy: script-src 'self' https://privatusstats.com; connect-src 'self' https://privatusstats.com

Directive	Why
`script-src https://privatusstats.com`	Loads `pa.js` and any modules (`pa.auto.js`, `pa.vitals.js`, `pa.clicks.js`)
`connect-src https://privatusstats.com`	Sends hits with `fetch`/`sendBeacon` to `/api/event`

Add these to your existing directives and keep everything else you already allow.

Older snippets#

Snippets made before the tracker had its own domain load pa.js from https://privatusanalytics.com. They keep working, and the script now sends its hits and loads its modules from https://privatusstats.com. Allow both:

http

Content-Security-Policy: script-src 'self' https://privatusanalytics.com https://privatusstats.com; connect-src 'self' https://privatusstats.com

Or replace the snippet with the one on Site settings → Tracking, which loads from https://privatusstats.com, and allow only that.

The queue stub and nonces#

The queue stub is an inline script. With a strict CSP, give it your page's nonce (<script nonce="…">) or move it into a file you serve.

Symptoms of a CSP block#

In the console: Refused to load the script… (missing script-src) or Refused to connect to… (missing connect-src). The Verify installation check on Site settings → Tracking reads the Content-Security-Policy header of the page it fetches and tells you whether script-src and connect-src (or default-src, when those are absent) allow privatusstats.com. See CSP errors.