Hello! We cant setup GTM to work on our forum: https://forum.warthunder.com/ As you can see there is error about content security policy. Refused to execute inline script because it violates the following Content Security Policy directive: "script-src https://forum.warthunder.com/logs/ https://forum.warthunder.com/sidekiq/ https://forum.warthunder.com/mini-profiler-resources/ https://forum.warthunder.com/assets/ https://forum.warthunder.com/brotli_asset/ https://forum.warthunder.com/extra-locales/ https://forum.warthunder.com/highlight-js/ https://forum.warthunder.com/javascripts/ https://forum.warthunder.com/plugins/ https://forum.warthunder.com/theme-javascripts/ https://forum.warthunder.com/svg-sprite/ https://www.googletagmanager.com/gtm.js 'nonce-857b78b0187f8ee53100212842747417' 'sha256-HZxBMVZe6P3MvHDZlFai9cUmLH+qwX6BNT3qTwNPATg='". Either the 'unsafe-inline' keyword, a hash ('sha256-93qwY4D574Ysts67Kmc0jpUYGBwBuG9q6hhQl+Kk9us='), or a nonce ('nonce-...') is required to enable inline execution. Urls are good in CSP header, and nonce is correct. Do you know what might be the problem? Thanks.

hi @Nikolaos_SP :wave: welcome to Meta :slight_smile: maybe have a look at this topic [image] Google Tag Manager (gtm) script blocked by CSP Data & reporting Hi there! I’m having a hard time figuring out why our GTM script is being blocked by our CSP: [Screenshot 2023-06-30 at 4.16.51 PM] Here’s the script: (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'sc…

Hello Lilly I read that article and alot of others on this forum, and nothing helped :frowning: Main page set CSP header correcly, there is gtm address in script src. And there is also nonce, but browser still for some reason block script loading. [image]

If i disable content security policy in admin panel, then it works normally. But that would be security risk then.

Actually isn’t that big risk, if at all. CSP is very unreliable way, and security will fall anyway because there is quite big must to allow everything, if one want keep things in work. But for you that is quite easy dilemma: do you really need that extra layer of security or do you need google tags? Or can you use Matomo instead?

@Nikolaos_SP I have added the googletagmanager.com domain to SCP whitelist and it worked for me. [image]

Cant get google tag manager to work

Community Building Data & reporting

Jagster (Jakke Flemming) August 14, 2023, 11:20am 4

What happends if you don’t use CSP, aka. Report-only?

Topic		Replies	Views
Google Tag Manager (gtm) script blocked by CSP Data & reporting analytics	4	5751	July 3, 2023
GTM usage error Data & reporting analytics	6	2220	January 21, 2020
GTM Refused to load the script because it violates the Content Security Policy Data & reporting	2	3800	June 16, 2021
Error in Content Security Policy and gtag.js Product Support	4	1761	April 13, 2021
GTM (Google Tag Manager) Integration Error Product Support	0	357	May 21, 2022

Cant get google tag manager to work

Related topics