Discourse uses a ‘strict-dynamic’ Content Security Policy, and attaches a nonce to the root GTM script.
That means that, in the vast majority of cases, no extra configuration is required. strict-dynamic will automatically trust any scripts you load via GTM.
If you use GTM Custom JavaScript Variables, then you will need to add 'unsafe-eval' to the content security policy script src site setting. Alternatively, you can update your GTM configuration to use ‘Custom Templates’ instead of ‘Custom Variables’.
Last edited by @MarkDoerr 2025-12-11T00:35:04Z
Last checked by @MarkDoerr 2025-12-11T00:32:25Z
Check document
Perform check on document: