# Google Tag Manager and Discourse CSP (Content Security Policy)

**URL:** https://meta.discourse.org/t/google-tag-manager-and-discourse-csp-content-security-policy/188296
**Category:** Integrations
**Tags:** how-to
**Created:** [April 27, 2021, 7:03pm UTC](https://meta.discourse.org/t/google-tag-manager-and-discourse-csp-content-security-policy/188296 "2021-04-27T19:03:01Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Discourse](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/discourse/32/148734_2.png) [@Discourse](https://meta.discourse.org/u/Discourse)
#### Post date: [April 27, 2021, 7:03pm UTC](https://meta.discourse.org/t/google-tag-manager-and-discourse-csp-content-security-policy/188296/1 "2021-04-27T19:03:01Z")

</div>

Discourse uses a [‘strict-dynamic’ Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243), and attaches a nonce to the root GTM script.

That means that, in the vast majority of cases, no extra configuration is required. `strict-dynamic` will automatically trust any scripts you load via GTM.

If you use GTM [Custom JavaScript Variables](https://developers.google.com/tag-platform/security/guides/csp#custom_javascript_variables), then you will need to add `'unsafe-eval'` to the `content security policy script src` site setting. Alternatively, you can update your GTM configuration to use ‘Custom Templates’ instead of ‘Custom Variables’.

> Last edited by @MarkDoerr 2025-12-11T00:35:04Z
> 
> Last checked by @MarkDoerr 2025-12-11T00:32:25Z
> 
> > **Check document**
> >
> > Perform check on document: