Skip to content
Tracking SOP

Consolidated CSP Reference

Every domain this tracking stack ultimately required — confirmed against the live site’s actual _headers file, not just remembered.

script-src

  1. 1.www.googletagmanager.com, www.google-analytics.com, googleads.g.doubleclick.net, www.googleadservices.com, connect.facebook.net, snap.licdn.com, www.clarity.ms, www.google.com, pagead2.googlesyndication.com, www.youtube.com (only if using GTM’s native YouTube trigger), static.cloudflareinsights.com (Cloudflare Web Analytics), the server-side tagging subdomain (e.g., data.yourdomain.com).

connect-src

  1. 1.www.google-analytics.com, analytics.google.com, region1.google-analytics.com (or the relevant regional subdomain), www.googletagmanager.com, stats.g.doubleclick.net, www.google.com, google.com, pagead2.googlesyndication.com, ad.doubleclick.net, www.facebook.com, px.ads.linkedin.com, www.clarity.ms, the server-side tagging subdomain.

img-src

  1. 1.www.googletagmanager.com, www.google-analytics.com, googleads.g.doubleclick.net, www.google.com, google.com, www.facebook.com, px.ads.linkedin.com, www.clarity.ms, pagead2.googlesyndication.com, www.googleadservices.com, ad.doubleclick.net, img.youtube.com.

frame-src

  1. 1.www.youtube-nocookie.com (or www.youtube.com depending on embed method), www.googletagmanager.com, the server-side tagging subdomain (required for the <noscript> GTM fallback iframe once loading from a first-party domain).

A correction worth knowing about

  1. 1.capi-automation.s3.us-east-2.amazonaws.com was previously listed here as required — confirmed via a live site check that it does not actually appear in the working site’s CSP at all. This is consistent with declining Meta’s auto-managed CAPI integration (the console message referencing this domain was tied to that declined feature, not the working Pixel/CAPI setup actually in use). No action needed — this entry was simply incorrect and has been removed.

Lesson learned

  1. 1.Adding LinkedIn’s domains (snap.licdn.com, px.ads.linkedin.com) proactively, before that phase was even reached, resulted in zero CSP errors when LinkedIn tracking was actually built — proactive CSP planning based on the full known platform list genuinely saves real time over reactive, error-by-error discovery.