> For the complete documentation index, see [llms.txt](https://cmp.docs.sirdata.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cmp.docs.sirdata.net/en/faq/content-security-policy-csp.md).

# Content Security Policy (CSP)

Which CSP rules to allow so the Sirdata CMP works fully?

A **Content Security Policy (CSP)** is a security rule your site sends to the browser. It lists the domains the page is allowed to load scripts, data (JSON), fonts, images and styles from. Anything not listed is blocked.

If the CMP's domains are not listed, the browser blocks all or part of the CMP.

### ✅ Recognizing a block

The symptom depends on the rule that blocks:

| What you see                                                                                                | CSP rule involved |
| ----------------------------------------------------------------------------------------------------------- | ----------------- |
| The CMP does not show at all                                                                                | `script-src`      |
| The banner shows, but the purposes screen ("Set your choices") is incomplete, or some partners have no name | `connect-src`     |
| The CMP shows without its styling                                                                           | `style-src`       |
| The CMP does not use the font chosen in its theme                                                           | `font-src`        |
| The CMP's logo or illustration is missing                                                                   | `img-src`         |

To confirm, open the browser console (**F12** key, **Console** tab). Each block is reported with a message like this one:

```
Refused to connect to 'https://api.consentframework.com/api/v1/public/list/gvl/3?...' because it violates the following Content Security Policy directive: "connect-src ..."
```

### ⚙ The rules to add

Add these sources **after the ones already present** in your CSP:

| Rule          | Sources to add                                                    | What they allow                                                              |
| ------------- | ----------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| `script-src`  | `https://*.consentframework.com`                                  | the CMP's scripts                                                            |
| `connect-src` | `https://*.consentframework.com`                                  | the texts and the partner list (JSON), saving the user's choices, statistics |
| `font-src`    | `https://*.consentframework.com`                                  | the font of the CMP's theme                                                  |
| `img-src`     | `data:` `https://*.consentframework.com` `https://cdn.sirdata.io` | icons, theme illustrations, the logo uploaded to the platform                |
| `style-src`   | `'unsafe-inline'`                                                 | the CMP's styling                                                            |

Example (the header fits on a single line, with rules separated by `;`):

```http
Content-Security-Policy: script-src 'self' https://*.consentframework.com; connect-src 'self' https://*.consentframework.com; font-src 'self' https://*.consentframework.com; img-src 'self' data: https://*.consentframework.com https://cdn.sirdata.io; style-src 'self' 'unsafe-inline'
```

{% hint style="info" %}
Add these sources to your current rules, without replacing them. If a rule is missing from your CSP while `default-src` is present, `default-src` applies in its place: add the missing rule in full.
{% endhint %}

#### Why `*.consentframework.com`?

The CMP uses several subdomains of `consentframework.com`, and the `*` wildcard covers them all. If your security policy forbids wildcards, here is the detail:

| Domain                          | Role                                                                 | Rules                             |
| ------------------------------- | -------------------------------------------------------------------- | --------------------------------- |
| `cache.consentframework.com`    | `stub` script                                                        | `script-src`                      |
| `choices.consentframework.com`  | `cmp` script and its code, fonts, illustrations                      | `script-src` `font-src` `img-src` |
| `api.consentframework.com`      | texts and partner list (JSON), saving the user's choices, statistics | `connect-src`                     |
| `mychoice.consentframework.com` | consent shared across several sites                                  | `connect-src`                     |

### 🧩 Special cases

#### Your CSP uses a nonce or `'strict-dynamic'`

Add your nonce to the CMP's tags. The scripts the CMP loads afterwards are allowed by `'strict-dynamic'`.

```html
<script nonce="YOUR_NONCE" src="https://cache.consentframework.com/js/pa/XXXXX/c/YYYYY/stub"></script>
<script nonce="YOUR_NONCE" src="https://choices.consentframework.com/js/pa/XXXXX/c/YYYYY/cmp" async></script>
```

#### Your `style-src` uses a nonce or a hash

The browser then ignores `'unsafe-inline'`, and the CMP shows without its styling: it injects its styles without a nonce. `style-src` must contain `'unsafe-inline'`, with no nonce or hash in the same rule.

#### You condition scripts with the CMP (`data-cmp-src`)

* The domains of the scripts you condition must be allowed in your CSP, as if they were loaded directly.
* If you condition a **local function** (`data-cmp-src="myFunction"`, see [Local script management](/en/script-management/local-script-management.md)), `script-src` must contain `'unsafe-eval'`. Without it, the function is never executed.

#### The CMP is loaded by Google Tag Manager

The [Sirdata template](/en/install/via-a-tag-manager/loading-via-google-tag-manager.md) loads the CMP from `https://choices.consentframework.com`: the rules above are enough for the CMP. Google Tag Manager has its own requirements, described in [Google's CSP guide](https://developers.google.com/tag-platform/security/guides/csp).

If you fill in a **first-party host** in the template, also add `https://cdn.sirdata.eu` to `script-src`, and your host as described below.

#### You use Sirdata's GTM server-side container

Your server-side sub-domain (for example `metrics.your-site.com`) serves the Google Tag Manager code and receives its measurement requests. With the **Load the CMP from the server-side host** option, it also serves the CMP: its scripts, texts, partner list, fonts and illustrations. Add it to these rules:

| Rule          | Source to add                   | What it allows                                                                                     |
| ------------- | ------------------------------- | -------------------------------------------------------------------------------------------------- |
| `script-src`  | `https://metrics.your-site.com` | the integration script, Google Tag Manager and the Google scripts served by the container; the CMP |
| `connect-src` | `https://metrics.your-site.com` | measurement requests (Google Analytics…); the CMP's texts, partner list and statistics             |
| `img-src`     | `https://metrics.your-site.com` | measurement requests sent as images; the CMP's illustrations                                       |
| `font-src`    | `https://metrics.your-site.com` | the CMP theme font                                                                                 |
| `frame-src`   | `https://metrics.your-site.com` | the iframe of Google's service worker, with the **Allow Google's Service Workers** option          |

When the CMP is served by the container, also keep:

* `data:` and `https://cdn.sirdata.io` in `img-src`: icons and the logo uploaded to the platform;
* `'unsafe-inline'` in `style-src`: the CMP styling;
* `https://mychoice.consentframework.com` in `connect-src`, if consent is shared across several of your sites.

When the CMP is not served by the container, apply the CMP rules described above (`https://*.consentframework.com`).

The tags that Google Tag Manager loads from Google's domains (Google Ads, Floodlight, etc.) have their own requirements, described in [Google's CSP guide](https://developers.google.com/tag-platform/security/guides/csp).

#### The CMP is served from your own domain

[Consent domain](/en/advanced-features/consent-domain.md), first-party host, custom CDN: add this domain to `script-src`, `connect-src`, `font-src` and `img-src`. Also keep `https://*.consentframework.com`: the CMP uses it as a fallback and for some calls.

#### Options that load an additional script

| Option                                                                               | Source to add                   | Rule         |
| ------------------------------------------------------------------------------------ | ------------------------------- | ------------ |
| [Amazon Consent Signal](/en/consent-transmission-standards/amazon-consent-signal.md) | `https://c.amazon-adsystem.com` | `script-src` |
| Sirdata data partnership: the CMP loads the Sirdata tag after consent                | `https://js.sddan.com`          | `script-src` |

#### Each partner's cookie details

On the partners screen, the **more** link in an IAB TCF partner's storage information loads a JSON file published by that partner, on its own domain (for example `privacy.criteo.com`). If `connect-src` blocks that domain, the panel shows "Information not available"; the rest of the CMP works.

To show it, add your partners' domains to `connect-src` (the browser console lists them when you open these panels), or `https:` if you accept to allow all HTTPS connections.

### 🔎 Test and validate

After the change, reload the page (**Ctrl + Shift + R**), then open the banner, **Set your choices** and the partners screen in turn. The console should no longer show any "Refused to … consentframework.com" message.

### 🌟 TL;DR

* **CMP missing, incomplete purposes screen or partners without a name** ✖: your CSP blocks all or part of the CMP
* **Solution** ✔: add `https://*.consentframework.com` to `script-src`, `connect-src`, `font-src` and `img-src`, plus `data:` and `https://cdn.sirdata.io` to `img-src`, and `'unsafe-inline'` to `style-src`
* **Sirdata GTM server-side container**: also add your server-side sub-domain to `script-src`, `connect-src`, `img-src`, `font-src` and `frame-src`
* **Where?** In your site's `Content-Security-Policy` HTTP header
* **Test**: the browser console should no longer report anything 🚀

If in doubt, share this FAQ with your developer (they’ll get it right away 😉). Need help? We're here for you! 💡


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cmp.docs.sirdata.net/en/faq/content-security-policy-csp.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.