Troubleshooting: Content Security Policy (CSP)

Why does this happen?

Your site is configured to restrict one or more security policies through a Content-Security-Policy header and doesn’t explicitly permit access to CrazyEgg.

Solving the Error

Ask your developer to update the Content-Security-Policy (CSP) header in the following way:

  1. Default Policy:
    • Add *.crazyegg.com to the default -src directive.
  2. If you have specific directives for any of the following, also add *.crazyegg.com to them:
    • script-src
    • connect-src
    • style-src
    • frame-src
    • img-src
  3. Handling blob::
    • If your CSP includes worker-src or child-src, add blob: to those directives.
    • Otherwise, add blob: to the default-src directive.
  4. Surveys & CTAs:
    • If you have a specific style-src directive add 'unsafe-inline' to it.
    • Additionally, allow Google Fonts by adding:
      • fonts.googleapis.com to style-src
      • fonts.gstatic.com to font-src

Here is an example CSP that covers all of these cases:

Content-Security-Policy: 
default-src 'self' *.crazyegg.com blob:;
script-src 'self' *.crazyegg.com;
connect-src 'self' *.crazyegg.com;
style-src 'self' *.crazyegg.com 'unsafe-inline' fonts.googleapis.com;
img-src 'self' *.crazyegg.com;
iframe-src 'self' *.crazyegg.com;
font-src 'self' fonts.gstatic.com;
worker-src 'self' blob:;
child-src 'self' blob:;
Was this article helpful?

Related Articles

Need Support?

Can’t find the answer you’re looking for? Don’t worry we’re here to help!

Submit a request