Content Security Policy (CSP)
A Content Security Policy (CSP) is a header that tells browsers which hosts your pages may load scripts, styles, images and other resources from. If your site sends one, it must allow Personizely's hosts, or the snippet is blocked and no campaigns or widgets run. This page lists every source Personizely needs, which ones are optional, and when you need 'unsafe-eval'.
Most Shopify Online Store themes don't send a CSP, so you can skip this page unless your browser console shows "Refused to load…" or "violates the following Content Security Policy directive" errors mentioning Personizely.
Required directives
Directive | Sources to add | Why |
|---|---|---|
script-src | https://static.personizely.net | The Personizely snippet, and the preview version used by preview links |
connect-src | https://t.personizely.net | Tracking events, targeting data, goals and form submissions |
style-src | 'unsafe-inline' | Widget styles, campaign CSS and anti-flicker styles are added to the page as inline styles |
img-src | https://*.personizely.net data: | Images you upload to widgets and template images are served from Personizely; small icons use inline images |
Directives for features you use
Feature | Directive | Sources to add |
|---|---|---|
Custom JavaScript: campaign or variation JS, widget custom JS, Execute JavaScript code automation, JS values in Change field value automation, variable Parsers (data parsing engine) and dynamic text from JavaScript variables | script-src | 'unsafe-eval' |
Google Fonts in widgets | style-src | https://fonts.googleapis.com |
| font-src | https://fonts.gstatic.com |
Custom fonts you uploaded | font-src | https://*.personizely.net |
Images from other hosts in widgets (your CDN, product images) | img-src | Those hosts, for example https://cdn.shopify.com |
frame-src | https://www.youtube.com https://player.vimeo.com https://www.dailymotion.com | |
frame-src | https://www.google.com | |
Company enrichment with Albacross | connect-src | https://reveal.api.albacross.com |
Company enrichment with Clearbit | connect-src | https://reveal.clearbit.com |
reCAPTCHA Form spam protection and email validation | script-src, frame-src | https://www.google.com https://www.gstatic.com (per Google's reCAPTCHA CSP guidance) |
Error reporting (optional) | connect-src | https://*.ingest.sentry.io. Personizely reports snippet errors to help us fix them; if blocked, Personizely still works |
On Shopify, keep 'self' in connect-src: Personizely may also send requests to your own store's domain.
Why 'unsafe-eval'
Code you write in Personizely, such as a variation's JavaScript or an Execute JavaScript code automation, is stored as text and run by the snippet when it applies. Browsers treat this as eval, so a CSP without 'unsafe-eval' blocks it. Everything else in Personizely works without 'unsafe-eval'. If you don't use custom JavaScript, leave it out.
Webflow sites connected through the Webflow integration can't run custom JavaScript at all, because Webflow requires it to be disabled. See Install Personizely on Webflow or Square.
Example policy
A site that uses widgets with Google Fonts and campaigns with custom JavaScript:
Content-Security-Policy:
script-src 'self' https://static.personizely.net 'unsafe-eval';
connect-src 'self' https://t.personizely.net;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src 'self' https://fonts.gstatic.com https://*.personizely.net;
img-src 'self' data: https://*.personizely.net;Merge these sources into your existing policy rather than replacing it.
Shopify Hydrogen
Hydrogen sets a CSP with createContentSecurityPolicy in entry.server. Add Personizely's sources there:
const { nonce, header, NonceProvider } = createContentSecurityPolicy({
shop: {
checkoutDomain: context.env.PUBLIC_CHECKOUT_DOMAIN,
storeDomain: context.env.PUBLIC_STORE_DOMAIN,
},
scriptSrc: ['https://static.personizely.net', "'unsafe-eval'"],
connectSrc: ['https://t.personizely.net'],
styleSrc: ["'unsafe-inline'", 'https://fonts.googleapis.com'],
fontSrc: ['https://fonts.gstatic.com', 'https://*.personizely.net'],
imgSrc: ['data:', 'https://*.personizely.net'],
});Drop 'unsafe-eval' if you don't use custom JavaScript. See Install Personizely on Shopify Hydrogen.
Behavior details and limitations
- Blocked snippet, original site. If script-src blocks the snippet, visitors see your original site and nothing is tracked.
- Blocked tracking, no data. If connect-src blocks the tracking host, widgets may still appear, but views, conversions and campaign results aren't recorded, and targeting that needs visitor history or location can't resolve.
- Blocked custom JavaScript fails quietly. Without 'unsafe-eval', custom code doesn't run, and the rest of the campaign or widget still does. Check the browser console for CSP errors.
- Nonces and hashes don't help with custom JavaScript. It runs from the snippet, not from an inline <script> tag, so allow 'unsafe-eval' instead.
- Shopify app embed. The Code snippet app embed adds a small inline script with store data (market, currency, product, cart) before the snippet. If your Shopify theme sends a CSP that blocks inline scripts, allow it.
- White-label agencies. Subaccounts of a white-label agency load the snippet and assets from the agency's own host instead of personizely.net. Copy the host from the script tag in Settings → Website. See Agencies, white label and subaccounts.
- Content-Security-Policy-Report-Only is a safe way to test: violations are reported in the console without blocking anything.
Troubleshooting
- Console: "Refused to load the script 'https://static.personizely.net/…'" → add https://static.personizely.net to script-src.
- Console: "Refused to connect to 'https://t.personizely.net/…'" → add it to connect-src.
- Console: "Refused to evaluate a string as JavaScript because 'unsafe-eval'…" → custom JavaScript is blocked. Add 'unsafe-eval' to script-src.
- Widgets show without styling, or in the wrong font → add 'unsafe-inline' to style-src, and the Google Fonts hosts if you use them.
- Widget images are broken → add https://*.personizely.net and the hosts of any external images to img-src.