You added Content-Security-Policy (CSP) to improve security, and now Google Analytics stops working. Data is missing, events are not tracked, and reports are empty. This is common: CSP blocks scripts and connections that are not explicitly allowed. This guide explains why CSP blocks Google Analytics and how to fix it.
What CSP does with Google Analytics
CSP restricts which scripts can load and which connections can be made. Google Analytics uses scripts, images and connections that must be allowed in CSP.
GA requires:
— script-src for analytics scripts;
— img-src for tracking pixels;
— connect-src for data transmission.
If these are not allowed, GA is blocked.
Why CSP blocks Google Analytics
By default, CSP blocks resources from domains not listed in the policy. Google Analytics uses several domains.
If not allowed:
— GA script is blocked;
— tracking pixels are blocked;
— data is not sent;
— reports are empty.
This can lead to missing data and incorrect decisions.
Reason 1: script-src missing GA domains
The most common issue. script-src does not include Google Analytics domains.
What to check:
— script-src includes google-analytics.com;
— includes googletagmanager.com if using GTM;
— includes other GA domains.
The fix: add GA domains to script-src.
Use CSP checker to see the current policy.
Reason 2: img-src missing GA domains
GA uses tracking pixels. If img-src does not allow them, tracking fails.
What to check:
— img-src includes google-analytics.com;
— includes googletagmanager.com;
— includes other GA domains.
The fix: add GA domains to img-src.
Reason 3: connect-src missing GA domains
GA sends data via connect-src. If not allowed, data is not sent.
What to check:
— connect-src includes google-analytics.com;
— includes googletagmanager.com;
— includes other GA domains.
The fix: add GA domains to connect-src.
Reason 4: inline GA script blocked
GA may use inline scripts. CSP blocks inline scripts unless nonce or hash is used.
What to check:
— is GA loaded via inline script;
— is nonce or hash used;
— is unsafe-inline used.
The fix: use nonce or hash, or move GA to external file.
Reason 5: GTM instead of GA
If Google Tag Manager is used, it loads GA. CSP must allow GTM domains.
What to check:
— is GTM used;
— are GTM domains allowed;
— are GA domains allowed.
The fix: add GTM and GA domains to CSP.
How to diagnose CSP GA issues
A practical sequence:
— check CSP header;
— check console for errors;
— check script-src;
— check img-src;
— check connect-src;
— test after changes.
If GA is blocked, the console shows CSP errors. For a broader audit, SEO audit can help verify CSP, analytics and security in one place.
How to fix CSP GA issues
Fix steps:
— add GA domains to script-src;
— add GA domains to img-src;
— add GA domains to connect-src;
— use nonce or hash for inline scripts;
— allow GTM domains if used;
— test after changes.
FAQ
Why does CSP block Google Analytics?
Because GA domains are not allowed in script-src, img-src or connect-src. CSP blocks resources from domains not listed.
What domains should I allow for GA?
google-analytics.com, googletagmanager.com and other GA domains. Check GA documentation for the full list.
Does CSP affect SEO?
Indirectly. If analytics is blocked, you lose data, which affects decisions. But CSP itself does not affect rankings.
Can I use unsafe-inline for GA?
Not recommended. Use nonce or hash instead. unsafe-inline weakens CSP.
What if GTM is used?
Allow GTM domains in CSP. GTM loads GA and other tags.
How do I check CSP errors?
Open the browser console. CSP violations show as errors with the violated directive.
Can CSP block GA tracking pixels?
Yes. If img-src does not allow GA domains, tracking pixels are blocked.
Can CSP block GA data transmission?
Yes. If connect-src does not allow GA domains, data is not sent.
What if only some GA features are blocked?
Check which directives are missing. Add the necessary domains to script-src, img-src and connect-src.
How often should I check CSP?
After adding or changing analytics, and periodically as part of a security audit.
