--- title: Content Security Policy (CSP) slug: csp description: The Content Security Policy directives Personizely needs: script, connect, image, style, font and frame sources, unsafe-eval for custom JS, and Hydrogen. docTags: createdAt: 2026-10-17T10:03:10.660Z --- A Content Security Policy (CSP) is a header that tells browsers which hosts your pages may load scripts, styles, images and other resources from. If your site sends one, it must allow Personizely's hosts, or the snippet is blocked and no campaigns or widgets run. This page lists every source Personizely needs, which ones are optional, and when you need `'unsafe-eval'`. Most Shopify Online Store themes don't send a CSP, so you can skip this page unless your browser console shows "Refused to load…" or "violates the following Content Security Policy directive" errors mentioning Personizely. ## Required directives | Directive | Sources to add | Why | | ------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------- | | `script-src` | `https://static.personizely.net` | The Personizely snippet, and the preview version used by preview links | | `connect-src` | `https://t.personizely.net` | Tracking events, targeting data, goals and form submissions | | `style-src` | `'unsafe-inline'` | Widget styles, campaign CSS and anti-flicker styles are added to the page as inline styles | | `img-src` | `https://*.personizely.net` `data:` | Images you upload to widgets and template images are served from Personizely; small icons use inline images | ## Directives for features you use | Feature | Directive | Sources to add | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Custom JavaScript: campaign or variation JS, widget custom JS, [Execute JavaScript code automation](docId:_JnT5evbben9oq_of9Ll_), JS values in [Change field value automation](docId\:v_G7CVz9VK6VbUALbnYAG), variable [Parsers (data parsing engine)](docId\:n_O3ZB1_JFa-N-aEZ4u3U) and dynamic text from JavaScript variables | `script-src` | `'unsafe-eval'` | | Google Fonts in widgets | `style-src` | `https://fonts.googleapis.com` | | | `font-src` | `https://fonts.gstatic.com` | | Custom fonts you uploaded | `font-src` | `https://*.personizely.net` | | Images from other hosts in widgets (your CDN, product images) | `img-src` | Those hosts, for example `https://cdn.shopify.com` | | [Video element](docId\:Z9DBd0LkVhvBqn5tzZjUJ) | `frame-src` | `https://www.youtube.com` `https://player.vimeo.com` `https://www.dailymotion.com` | | [Map element](docId\:kK29bfsntBOTD5wutMayH) | `frame-src` | `https://www.google.com` | | Company enrichment with Albacross | `connect-src` | `https://reveal.api.albacross.com` | | Company enrichment with Clearbit | `connect-src` | `https://reveal.clearbit.com` | | reCAPTCHA [Form spam protection and email validation](docId\:KjsRVFmsQhMDvGZpG7MwY) | `script-src`, `frame-src` | `https://www.google.com` `https://www.gstatic.com` (per Google's reCAPTCHA CSP guidance) | | Error reporting (optional) | `connect-src` | `https://*.ingest.sentry.io`. Personizely reports snippet errors to help us fix them; if blocked, Personizely still works | On Shopify, keep `'self'` in `connect-src`: Personizely may also send requests to your own store's domain. ### Why `'unsafe-eval'` Code you write in Personizely, such as a variation's JavaScript or an Execute JavaScript code automation, is stored as text and run by the snippet when it applies. Browsers treat this as `eval`, so a CSP without `'unsafe-eval'` blocks it. Everything else in Personizely works without `'unsafe-eval'`. If you don't use custom JavaScript, leave it out. :::hint{type="info"} Webflow sites connected through the Webflow integration can't run custom JavaScript at all, because Webflow requires it to be disabled. See [Install Personizely on Webflow or Square](docId\:YVZwa6h2XOAPCEogmj-rn). ::: ## Example policy A site that uses widgets with Google Fonts and campaigns with custom JavaScript: ```http Content-Security-Policy: script-src 'self' https://static.personizely.net 'unsafe-eval'; connect-src 'self' https://t.personizely.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com https://*.personizely.net; img-src 'self' data: https://*.personizely.net; ``` Merge these sources into your existing policy rather than replacing it. ## Shopify Hydrogen Hydrogen sets a CSP with `createContentSecurityPolicy` in `entry.server`. Add Personizely's sources there: ```javascript const { nonce, header, NonceProvider } = createContentSecurityPolicy({ shop: { checkoutDomain: context.env.PUBLIC_CHECKOUT_DOMAIN, storeDomain: context.env.PUBLIC_STORE_DOMAIN, }, scriptSrc: ['https://static.personizely.net', "'unsafe-eval'"], connectSrc: ['https://t.personizely.net'], styleSrc: ["'unsafe-inline'", 'https://fonts.googleapis.com'], fontSrc: ['https://fonts.gstatic.com', 'https://*.personizely.net'], imgSrc: ['data:', 'https://*.personizely.net'], }); ``` Drop `'unsafe-eval'` if you don't use custom JavaScript. See [Install Personizely on Shopify Hydrogen](docId:_zNTHPizNHrgdObe0mul5). ## Behavior details and limitations - **Blocked snippet, original site.** If `script-src` blocks the snippet, visitors see your original site and nothing is tracked. - **Blocked tracking, no data.** If `connect-src` blocks the tracking host, widgets may still appear, but views, conversions and campaign results aren't recorded, and targeting that needs visitor history or location can't resolve. - **Blocked custom JavaScript fails quietly.** Without `'unsafe-eval'`, custom code doesn't run, and the rest of the campaign or widget still does. Check the browser console for CSP errors. - **Nonces and hashes don't help with custom JavaScript.** It runs from the snippet, not from an inline `