DataSag guides · Updated 27 October 2026

Configure CSP for DataSag analytics on HTML websites

A restrictive Content Security Policy must permit the tracker script and its delivery endpoint. Merge DataSag's exact origin into the relevant directives while preserving the rest of your policy. This guide applies to HTML websites.

Start with the HTML websites installation

Paste the script into head in your shared HTML template. If the site has no shared template, add it to each document you want measured. Replace the example public key, upload the changed files and check a nested page as well as the homepage.

A homepage-only edit misses independent HTML documents. If you later introduce shared includes, remove old per-page copies so the final rendered page has one tracker.

Use the public project key from the DataSag project you are inspecting. A test on a preview domain does not confirm that the production domain has the same code or settings.

Configure CSP for DataSag analytics in HTML websites

  1. Inspect both the production response headers and any CSP meta element in the HTML. Find whether the server configuration, hosting dashboard, or document owns the policy before you edit the script tag.
  2. Merge the DataSag script and delivery origin into the actual applicable directives. Preserve existing nonce or hash requirements. If the server and document each set a policy, the browser must satisfy both.
  3. Publish the policy change and check a nested HTML file directly. Verify the script and a pageview under enforcement. Avoid assuming a root-directory header rule also covers every independently served path.

The effective server and document policies permit the required DataSag resources on each tested HTML entry.

Complete the collection checks

  1. Read the existing response Content-Security-Policy headers and the browser violation message. Identify the directive actually blocking the resource. Multiple policies apply together, so adding a looser second header may not solve the block.
  2. Allow https://www.datasag.com in script-src or the applicable script-src-elem directive. Keep your existing nonce, hash and strict-dynamic rules; nonce-based policies may require your site's nonce on the script tag.
  3. Permit https://www.datasag.com in connect-src for sendBeacon and fetch requests to /api/track. The script derives the endpoint from its own source origin.
  4. If you want the tracker's image fallback to be available, allow the same origin in img-src. A successful normal beacon does not require the image fallback to run.
  5. Test a real pageview and custom event with the policy active. If your deployment supports it, use a report-only policy to evaluate a change before enforcing it.
  6. Keep inline handlers and unsafe-inline out of the solution. DataSag's external script does not require you to disable CSP or broadly allow every third-party origin.
/* Merge into existing directives; this is NOT a complete policy. */
script-src: add https://www.datasag.com
connect-src: add https://www.datasag.com
img-src: add https://www.datasag.com if enabling image fallback

What a successful check looks like

The exact tracker origin is permitted under the site's actual policy, tracking requests succeed and the Console no longer reports the corresponding violation.

Record the public path you tested, the browser state, the approximate time and the observed request. Check one direct page load and one later navigation so the result covers more than the homepage.

Common mistake

Do not paste the illustrative lines as a response header. Your host, framework or security middleware owns the complete policy, including syntax and nonces.

Installation snippet for HTML websites

The shared installation belongs in the head of every HTML document or shared template. Use this as the installation reference while checking the procedure above.

<script defer src="https://www.datasag.com/tracker.js" data-datasag-key="YOUR_PUBLIC_KEY"></script>

Related HTML websites guides

Full HTML websites setup guide · Search and AI visibility

References

Official HTML websites documentation covers the integration point. For policy directives, see the CSP documentation. Use support if a request fails after these checks.