# How to add analytics and pixel scripts avoiding Content Security Policy (XSS)

**URL:** https://meta.discourse.org/t/how-to-add-analytics-and-pixel-scripts-avoiding-content-security-policy-xss/321022
**Category:** Data & reporting
**Tags:** analytics
**Created:** [August 10, 2024, 11:31am UTC](https://meta.discourse.org/t/how-to-add-analytics-and-pixel-scripts-avoiding-content-security-policy-xss/321022 "2024-08-10T11:31:56Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![illusionandcards](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/illusionandcards/32/306500_2.png) [@illusionandcards](https://meta.discourse.org/u/illusionandcards)
#### Post date: [August 10, 2024, 11:31am UTC](https://meta.discourse.org/t/how-to-add-analytics-and-pixel-scripts-avoiding-content-security-policy-xss/321022/1 "2024-08-10T11:31:56Z")

</div>

Good day,

I’ve tried to add the Facebook Pixel script and Posthog analytics to my site with a custom component and editing the html from the default theme.

These are not working because of Content Security Policy. I even tried hashing the script with sha256, but I get this error when adding it to “content security policy script src”:

 ![image](https://global.discourse-cdn.com/meta/original/4X/6/8/1/681c4b26edc8eedc4a6e076fed9d127eb7b23284.png)

I’ve also read this topic: [Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)

How can I avoid CSP on specific scripts?

Thank you!

---

<div class="post-metadata">

### Author: ![illusionandcards](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/illusionandcards/32/306500_2.png) [@illusionandcards](https://meta.discourse.org/u/illusionandcards)
#### Post date: [August 10, 2024, 11:52am UTC](https://meta.discourse.org/t/how-to-add-analytics-and-pixel-scripts-avoiding-content-security-policy-xss/321022/2 "2024-08-10T11:52:15Z")

</div>

I’ve even disabled the Content Security Policy and added “unsafe-eval” con scripts src, but it’s still not working.

 ![image](https://global.discourse-cdn.com/meta/original/4X/2/3/3/233d4ed10bd0e6d13bfc4d53456acb4fbc9daac8.png)

Here is my custom component (in the head):

 ![image](https://global.discourse-cdn.com/meta/original/4X/7/1/a/71a363f6b5a29fa0a26112e7cac272d189ae9c4c.png)

---

<div class="post-metadata">

### Author: ![jericson](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jericson/32/116215_2.png) [@jericson](https://meta.discourse.org/u/jericson)
#### Post date: [September 7, 2024, 11:42pm UTC](https://meta.discourse.org/t/how-to-add-analytics-and-pixel-scripts-avoiding-content-security-policy-xss/321022/3 "2024-09-07T23:42:36Z")

</div>

I recently added PostHog to several sites and didn’t need to change any CSP settings. (I haven’t tried Facebook Pixel. It might help to add one thing at a time.) My technique was to use a Theme Component:

> **[Starting using PostHog with Discourse](https://beta.buildcivitas.com/t/starting-using-posthog-with-discourse/203)**
>
> PostHog works as a replacement for Google Analytics if you don’t want to share your visitors’ data with Google. It also adds a lot of other features such as being able to capture session recordings and JavaScript events out of the box. After...

> [@illusionandcards](#):
>
> I’ve even disabled the Content Security Policy and added “unsafe-eval” con scripts src, but it’s still not working.

That’s a strong signal CSP isn’t the problem.

Try starting with just PostHog in the beginning and see if that works. If it does, try just Meta Pixel.

For what it’s worth, the PostHog toolbar doesn’t work out of the box with Discourse. See:

> **[Toolbar not loading or displaying - Toolbar - Docs - PostHog](https://posthog.com/docs/toolbar#toolbar-not-loading-or-displaying)**
>
> Note: The PostHog toolbar is only available for the JavaScript web SDK. | Note: The PostHog toolbar is only available for the JavaScript web SDK . The toolbar is like "Inspect Element" for PostHog features and data. When…