# Add own CSP headers

**URL:** https://meta.discourse.org/t/add-own-csp-headers/265291
**Category:** Support
**Created:** [May 17, 2023, 6:54am UTC](https://meta.discourse.org/t/add-own-csp-headers/265291 "2023-05-17T06:54:16Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![nodomain](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nodomain/32/303402_2.png) [@nodomain](https://meta.discourse.org/u/nodomain)
#### Post date: [May 17, 2023, 6:54am UTC](https://meta.discourse.org/t/add-own-csp-headers/265291/1 "2023-05-17T06:54:16Z")

</div>

I am using the standard Docker based install. In our template we need to include Adobe Tag Manager which is loaded from [assets.adobedtm.com](http://assets.adobedtm.com). The default CSP headers prevent loading of the script.

How can I add or extend the default CSP headers in a “supported” non-hacky way?

---

<div class="post-metadata">

### Author: ![Jagster](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jagster/32/192154_2.png) [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [May 17, 2023, 8:02am UTC](https://meta.discourse.org/t/add-own-csp-headers/265291/2 "2023-05-17T08:02:42Z")

</div>

Is

- not using CSP by Discourse
- using CSP via reverse proxy or similar

hacky way?

---

<div class="post-metadata">

### Author: ![nodomain](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nodomain/32/303402_2.png) [@nodomain](https://meta.discourse.org/u/nodomain)
#### Post date: [May 17, 2023, 8:06am UTC](https://meta.discourse.org/t/add-own-csp-headers/265291/3 "2023-05-17T08:06:31Z")

</div>

I just need to know how I can add it e.g. during build of the container to be able to automate it…

---

<div class="post-metadata">

### Author: ![Lhc\_fl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lhc_fl/32/268115_2.png) [@Lhc\_fl](https://meta.discourse.org/u/Lhc_fl)
#### Post date: [May 17, 2023, 8:33am UTC](https://meta.discourse.org/t/add-own-csp-headers/265291/4 "2023-05-17T08:33:24Z")

</div>

Do you mean “content security policy script src” in site settings?

---

<div class="post-metadata">

### Author: ![nodomain](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nodomain/32/303402_2.png) [@nodomain](https://meta.discourse.org/u/nodomain)
#### Post date: [May 17, 2023, 9:00am UTC](https://meta.discourse.org/t/add-own-csp-headers/265291/5 "2023-05-17T09:00:16Z")

</div>

Yes!

And how can I amend e.g. connect-src or other attributes of the policy?

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [June 16, 2023, 9:09am UTC](https://meta.discourse.org/t/add-own-csp-headers/265291/7 "2023-06-16T09:09:45Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.