DataSag guides · Updated 27 October 2026

Configure CSP for DataSag analytics on your website

A restrictive Content Security Policy must permit the tracker script and its delivery endpoint. Merge DataSag's exact origin into the relevant directives while preserving the rest of your policy.

Before you start

Install the DataSag script once on the pages you intend to measure. Use the public key from the project you are inspecting. Publish your change, then test the public domain rather than relying on an editor preview.

Account credentials, database credentials and provider API keys do not belong in the tracking snippet. Keep existing consent controls in place. Report availability depends on your current plan and provider connections.

Configure CSP for DataSag analytics: step by step

Read the existing response Content-Security-Policy headers and the browser violation message. Identify the directive actually blocking the resource. Multiple policies apply together, so adding a looser second header may not solve the block.
Allow https://www.datasag.com in script-src or the applicable script-src-elem directive. Keep your existing nonce, hash and strict-dynamic rules; nonce-based policies may require your site's nonce on the script tag.
Permit https://www.datasag.com in connect-src for sendBeacon and fetch requests to /api/track. The script derives the endpoint from its own source origin.
If you want the tracker's image fallback to be available, allow the same origin in img-src. A successful normal beacon does not require the image fallback to run.
Test a real pageview and custom event with the policy active. If your deployment supports it, use a report-only policy to evaluate a change before enforcing it.
Keep inline handlers and unsafe-inline out of the solution. DataSag's external script does not require you to disable CSP or broadly allow every third-party origin.

/* Merge into existing directives; this is NOT a complete policy. */
script-src: add https://www.datasag.com
connect-src: add https://www.datasag.com
img-src: add https://www.datasag.com if enabling image fallback

What a successful check looks like

The exact tracker origin is permitted under the site's actual policy, tracking requests succeed and the Console no longer reports the corresponding violation.

Record the tested URL, date, browser state and observed request. Repeat on a nested page to check the shared installation. Keep the evidence so you can distinguish a later regression from a report-filter change.

Common mistake

Do not paste the illustrative lines as a response header. Your host, framework or security middleware owns the complete policy, including syntax and nonces.

Find your platform's installation point

Policy reference

Read the MDN Content Security Policy documentation before changing a full policy. The examples above identify allowed origins and are not a complete response header.