# Forgot to edit CSP when adding tracking code via custom component

**URL:** https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811
**Category:** Support
**Created:** [January 2, 2021, 4:18pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811 "2021-01-02T16:18:22Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Antony](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/antony/32/204487_2.png) [@Antony](https://meta.discourse.org/u/Antony)
#### Post date: [January 2, 2021, 4:18pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/1 "2021-01-02T16:18:22Z")

</div>

I’ve tried to add

in **`</head>`**

```plaintext
<!-- Matomo - head -->
<script type="text/discourse-plugin" version="0.2">
    // Track page views 
    api.onPageChange((url, title) => {
        if (_paq) {
            try {
                var currentUser = PreloadStore.get('currentUser');
                _paq.push(['setCustomVariable', 3, 'Forum status', !currentUser ? 'Anonymous' : 'LoggedIn user', 'visit']);
            } catch(e) {} 
              
            _paq.push(["setCustomUrl", url]);
            _paq.push(["setDocumentTitle", title]);
            _paq.push(["trackPageView"]);
        }
    });
</script>
<!-- /Matomo - head -->

```

then in **`</body>`**

```plaintext
<!-- Matomo -->
<script type="text/javascript">
  var _paq = window._paq = window._paq || [];
  /* tracker methods like "setCustomDimension" should be called before "trackPageView" */
  _paq.push(['trackPageView']);
  _paq.push(['enableLinkTracking']);
  (function() {
    var u="https://stats.xxxxxxx.xxx/";
    _paq.push(['setTrackerUrl', u+'matomo.php']);
    _paq.push(['setSiteId', '8']);
    var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
    g.type='text/javascript'; g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
  })();
</script>
<!-- End Matomo Code -->

```

And all I get is html source of the page is the html comments. `<script>` tags seam to have been removed.  
Is there a security setting to be activated as to allow scripts in those areas?

```plaintext
<!-- Matomo - head -->

<!-- /Matomo - head -->
[...]
<!-- Matomo -->

<!-- End Matomo Code -->

```

Thanks for your help

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 2, 2021, 4:27pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/2 "2021-01-02T16:27:53Z")

</div>

You should use this [Script to enable Matomo analytics on Discourse](https://meta.discourse.org/t/script-to-enable-matomo-analytics-on-discourse/33090)

---

<div class="post-metadata">

### Author: ![Antony](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/antony/32/204487_2.png) [@Antony](https://meta.discourse.org/u/Antony)
#### Post date: [January 2, 2021, 4:37pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/3 "2021-01-02T16:37:57Z")

</div>

Thanks you, that should solve my current problem…

But shouldn’t it be possible to inject custom js in those sections anyhow ?

---

<div class="post-metadata">

### Author: ![Antony](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/antony/32/204487_2.png) [@Antony](https://meta.discourse.org/u/Antony)
#### Post date: [January 2, 2021, 4:44pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/4 "2021-01-02T16:44:17Z")

</div>

I’ve installed the component and activated it for “Default” theme … and doesn’t seem to work any better :-/

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 2, 2021, 4:46pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/5 "2021-01-02T16:46:45Z")

</div>

Did you check your browser logs? Have you added your Matomo script host to the CSP setting list?

---

<div class="post-metadata">

### Author: ![Antony](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/antony/32/204487_2.png) [@Antony](https://meta.discourse.org/u/Antony)
#### Post date: [January 2, 2021, 4:57pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/6 "2021-01-02T16:57:31Z")

</div>

You got it right… I was not aware of a CSP setting…

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 2, 2021, 5:04pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/7 "2021-01-02T17:04:27Z")

</div>

That is something the browser logs will always warn about, so always check those.

---

<div class="post-metadata">

### Author: ![Tuhadj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tuhadj/32/166173_2.png) [@Tuhadj](https://meta.discourse.org/u/Tuhadj)
#### Post date: [January 28, 2021, 11:51am UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/8 "2021-01-28T11:51:26Z")

</div>

Hi @Falco I think I’ve got the same problem with Matomo not working with Discourse. It is what the support team of Matomo told me when [I opened a ticket on their github](https://github.com/matomo-org/matomo/issues/17157) :

> _Matomo support :_ “I checked your website and the configured CSP is preventing to load our tracker. You’ll want to have a look at [Is the Matomo JavaScript Tracker CSP (Content Security Policy) compatible and how do I set it up? FAQ - Analytics Platform - Matomo](https://matomo.org/faq/general/faq_20904/) and check how this can be configured in your server environment.”

I went to my Discourse logs (URL/logs) and couldn’t find anything related.

My discourse is on this URL : [https://hec.fm](https://hec.fm)  
And my Matomo instance on : [https://stats.hec.fm](https://stats.hec.fm)

And I thought I already changed the CSP in the settings to make it work but still not working :

 ![CSP not working Matomo](https://global.discourse-cdn.com/meta/original/3X/a/0/a0baab34415e27a419cc2af1024e8be9c256838a.png)

I thought I followed thoroughly the tutorial [Script to enable Matomo analytics on Discourse](https://meta.discourse.org/t/script-to-enable-matomo-analytics-on-discourse/33090) but seems not enough.

What did I do wrong ? 🙂

---

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [January 28, 2021, 1:55pm UTC](https://meta.discourse.org/t/forgot-to-edit-csp-when-adding-tracking-code-via-custom-component/174811/9 "2021-01-28T13:55:38Z")

</div>

I see the Matomo script loading correctly on hec.fm, so you’re not having a CSP issue. Maybe it’s something else on the Matomo side?

Also the rows below `https://stats.hec.fm/Matomo` in your screenshot above are unnecessary.