# Cant get google tag manager to work

**URL:** https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805
**Category:** Data & reporting
**Tags:** analytics
**Created:** [August 11, 2023, 2:52pm UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805 "2023-08-11T14:52:14Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Nikolaos\_SP](https://avatars.discourse-cdn.com/v4/letter/n/b9e5f3/32.png) [@Nikolaos\_SP](https://meta.discourse.org/u/Nikolaos_SP)
#### Post date: [August 11, 2023, 2:52pm UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805/1 "2023-08-11T14:52:14Z")

</div>

Hello!

We cant setup GTM to work on our forum: [https://forum.warthunder.com/](https://forum.warthunder.com/)

As you can see there is error about content security policy.

```plaintext
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src https://forum.warthunder.com/logs/ https://forum.warthunder.com/sidekiq/ https://forum.warthunder.com/mini-profiler-resources/ https://forum.warthunder.com/assets/ https://forum.warthunder.com/brotli_asset/ https://forum.warthunder.com/extra-locales/ https://forum.warthunder.com/highlight-js/ https://forum.warthunder.com/javascripts/ https://forum.warthunder.com/plugins/ https://forum.warthunder.com/theme-javascripts/ https://forum.warthunder.com/svg-sprite/ https://www.googletagmanager.com/gtm.js 'nonce-857b78b0187f8ee53100212842747417' 'sha256-HZxBMVZe6P3MvHDZlFai9cUmLH+qwX6BNT3qTwNPATg='". Either the 'unsafe-inline' keyword, a hash ('sha256-93qwY4D574Ysts67Kmc0jpUYGBwBuG9q6hhQl+Kk9us='), or a nonce ('nonce-...') is required to enable inline execution.

```

Urls are good in CSP header, and nonce is correct.

Do you know what might be the problem?

Thanks.

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [August 11, 2023, 3:15pm UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805/2 "2023-08-11T15:15:41Z")

</div>

hi @Nikolaos_SP 👋 welcome to Meta 🙂

maybe have a look at this topic

> [@Google Tag Manager (gtm) script blocked by CSP](https://meta.discourse.org/t/google-tag-manager-gtm-script-blocked-by-csp/270210):
>
> Hi there! I’m having a hard time figuring out why our GTM script is being blocked by our CSP: Here’s the script: \<!-- Google Tag Manager --\> \<script\>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'sc…

---

<div class="post-metadata">

### Author: ![Nikolaos\_SP](https://avatars.discourse-cdn.com/v4/letter/n/b9e5f3/32.png) [@Nikolaos\_SP](https://meta.discourse.org/u/Nikolaos_SP)
#### Post date: [August 14, 2023, 11:15am UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805/3 "2023-08-14T11:15:00Z")

</div>

Hello Lilly

I read that article and alot of others on this forum, and nothing helped ☹

Main page set CSP header correcly, there is gtm address in script src. And there is also nonce, but browser still for some reason block script loading.

 ![image](https://global.discourse-cdn.com/meta/original/4X/9/e/b/9eb4f26e4fce98d02f8d9951b0ecaf667498c076.png)

---

<div class="post-metadata">

### Author: ![Jagster](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jagster/32/192154_2.png) [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [August 14, 2023, 11:20am UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805/4 "2023-08-14T11:20:05Z")

</div>

What happends if you don’t use CSP, aka. Report-only?

---

<div class="post-metadata">

### Author: ![Nikolaos\_SP](https://avatars.discourse-cdn.com/v4/letter/n/b9e5f3/32.png) [@Nikolaos\_SP](https://meta.discourse.org/u/Nikolaos_SP)
#### Post date: [August 14, 2023, 3:58pm UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805/5 "2023-08-14T15:58:46Z")

</div>

If i disable content security policy in admin panel, then it works normally.  
But that would be security risk then.

---

<div class="post-metadata">

### Author: ![Jagster](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jagster/32/192154_2.png) [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [August 14, 2023, 6:53pm UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805/6 "2023-08-14T18:53:20Z")

</div>

Actually isn’t that big risk, if at all. CSP is very unreliable way, and security will fall anyway because there is quite big must to allow everything, if one want keep things in work.

But for you that is quite easy dilemma: do you really need that extra layer of security or do you need google tags? Or can you use Matomo instead?

---

<div class="post-metadata">

### Author: ![jboilesen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jboilesen/32/330126_2.png) [@jboilesen](https://meta.discourse.org/u/jboilesen)
#### Post date: [September 29, 2023, 1:07pm UTC](https://meta.discourse.org/t/cant-get-google-tag-manager-to-work/274805/7 "2023-09-29T13:07:11Z")

</div>

@Nikolaos_SP

I have added the [googletagmanager.com](http://googletagmanager.com) domain to SCP whitelist and it worked for me.

 ![image](https://global.discourse-cdn.com/meta/original/4X/4/c/4/4c4066efede6f9544a2eff1a63100ea5a111c890.png)