# Any approved method for adding Javascript before body close?

**URL:** https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126
**Category:** Support
**Created:** [November 3, 2020, 3:22pm UTC](https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126 "2020-11-03T15:22:32Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [November 3, 2020, 3:22pm UTC](https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126/1 "2020-11-03T15:22:32Z")

</div>

I have researched this a bit and am familiar with the security reasoning, etc. But is has their been any method created for doing this yet? I have an anti-ad block script I would like to run and it’s suppose to be inserted prior to` </body>` and adding it to the theme yields nada. I assume the security routines are removing it? Either way it’s not loading for me in the `</body>` or “Footer” options in the theme customization area.

Fyi this is just pure js and not a remote link to a file, etc.

Thanks,  
Jim

---

<div class="post-metadata">

### Author: ![rolando](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rolando/32/193660_2.png) [@rolando](https://meta.discourse.org/u/rolando)
#### Post date: [November 3, 2020, 3:39pm UTC](https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126/2 "2020-11-03T15:39:16Z")

</div>

have you placed your js inside script tags in your \< /body\>?:

```
<script type="text/javascript">

 <<< JS >>

</script>

```

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [November 3, 2020, 5:37pm UTC](https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126/3 "2020-11-03T17:37:14Z")

</div>

Yes I have already put the script in on the Desktop version of `</body>`.

```
<script type="text/javascript" charset="utf-8">
eval(function....
</script>

```

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [November 3, 2020, 5:44pm UTC](https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126/4 "2020-11-03T17:44:38Z")

</div>

Hmm… well I see that a file WITH the script is being put in the footer via:

`<script src="[/theme-javascripts/854aca489ba48a598e9eefaa2e4e255ac2a445b7.js?__ws=mywebsite.com](https://mywebsite.com/theme-javascripts/854aca489ba48a598e9eefaa2e4e255ac2a445b7.js?__ws=mywebsite.com)"></script>`

Going to that file (for me) displays the same JS I put in the customize themes area.

But as far as I can tell it’s not working as it normally does on other sites (being I have ad blocker activated).

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [November 3, 2020, 5:48pm UTC](https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126/5 "2020-11-03T17:48:30Z")

</div>

Okay… so there is this exception/error in the JS console:

Uncaught EvalError: Refused to evaluate a string as JavaScript because ‘unsafe-eval’ is not an allowed source of script in the following Content Security Policy directive: "script-src…

So it there a way to make “eval” safe or authorize this particular usage?

---

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [November 5, 2020, 2:25am UTC](https://meta.discourse.org/t/any-approved-method-for-adding-javascript-before-body-close/169126/6 "2020-11-05T02:25:28Z")

</div>

> [@Jim\_Starkweather](#):
>
> Uncaught EvalError: Refused to evaluate a string as JavaScript because ‘unsafe-eval’ is not an allowed source of script in the following Content Security Policy directive: "script-src…

You can whitelist evals in the content security policy site setting, see [Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243).

We do not recommend this though, it opens your site to security exploits.