# Can't get script tag to work in landing pages plugin due to content-security-policy

**URL:** https://meta.discourse.org/t/cant-get-script-tag-to-work-in-landing-pages-plugin-due-to-content-security-policy/372200
**Category:** Support
**Created:** [June 30, 2025, 12:54am UTC](https://meta.discourse.org/t/cant-get-script-tag-to-work-in-landing-pages-plugin-due-to-content-security-policy/372200 "2025-06-30T00:54:47Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![awesomerobot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/awesomerobot/32/142900_2.png) [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [June 30, 2025, 1:12pm UTC](https://meta.discourse.org/t/cant-get-script-tag-to-work-in-landing-pages-plugin-due-to-content-security-policy/372200/2 "2025-06-30T13:12:38Z")

</div>

There’s some information in this post that may help: [Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243#p-510350-csp-and-third-party-integrations-8)

> [@Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/1):
>
> ## CSP and third-party integrations
> 
> When using third-party services like Google Tag Manager, Google Analytics, or advertising services, you may need to adjust your CSP settings. In most cases with Discourse version 3.3.0.beta1 or later, external scripts should work without additional configuration due to the ‘strict-dynamic’ CSP implementation.
> 
> If you encounter issues, you may need to:
> 
> 1. Identify the required script sources by monitoring your browser console
> 2. Add the necessary sources to the `content_security_policy_script_src` setting
> 3. For complex integrations like ad services which load external resources, you might need to enable cross-domain rendering ([Example PR from discourse-adplugin](https://github.com/discourse/discourse-adplugin/pull/201) that does this).
> 
> ## Best practices
> 
> 1. Start with CSP Report-Only mode to identify potential issues
> 2. Gradually tighten your CSP as you resolve legitimate violations
> 3. Regularly review your CSP settings and adjust as needed
> 4. Be cautious when adding permissive directives like `'unsafe-eval'` or `'wasm-unsafe-eval'`
> 5. Keep your Discourse instance updated to benefit from the latest CSP improvements

---

_[View the full topic](https://meta.discourse.org/t/cant-get-script-tag-to-work-in-landing-pages-plugin-due-to-content-security-policy/372200)._