Google Tag Manager & GA4 with CSP Foundry
This opens with the Tag Manager and GA4 presets selected. The sources come from Google's own tag platform CSP guide, linked beside each preset in the tool.
- Select Google Tag Manager and Google Analytics 4 and read the notes below the checkboxes.
- Decide between a nonce for the GTM container snippet or allowing inline scripts (discouraged).
- Deploy as Report-Only and watch for tags you add inside GTM, which bring their own origins.
- Add each tag's origin only after you confirm you want that vendor to run script on your page.
What to know
Google's CSP guide for its tag platform lists the sources. For Google Tag Manager with a nonce, the container loader needs script-src-elem with your nonce and https://www.googletagmanager.com. Without a nonce the guide shows allowing inline scripts, which it discourages. For GA4 the guide lists https://www.googletagmanager.com for scripts, https://www.googletagmanager.com and https://*.google-analytics.com for images, and those plus https://*.google.com for connections. With Google Ads features it adds the doubleclick endpoints and requires each Google country domain you use to be listed individually.
The security catch is that GTM runs whatever tags are in the container. Every tag that loads a script or pixel needs its own origin in the policy, and a policy that allows www.googletagmanager.com effectively trusts the tags configured in that container. Google's own host is also on public lists of hosts with JSONP endpoints, so the Evaluate tab will flag allowlisting it; a nonce with strict-dynamic is the stronger setup.
Custom JavaScript variables in GTM need 'unsafe-eval' according to the guide, which weakens the policy. If you can, avoid them, and review which tags in the container really need to run on every page, because each tag that loads script from another vendor needs its own entry in the policy and widens what the page trusts.
Updated · Cosmovex
Questions
What CSP does Google Tag Manager need?
A nonce (or inline allowance) for the container snippet, and https://www.googletagmanager.com in script-src. For GA4 inside GTM also img-src and connect-src entries for googletagmanager.com and google-analytics.com, per Google's guide.
Does Google Analytics 4 need unsafe-inline?
Not if you load gtag.js from an external file and avoid inline configuration. The inline configuration snippet needs a nonce or hash.
Why do GTM tags break after I add CSP?
Each tag loads its own scripts, pixels or connections from its vendor's domains. Those origins must be added too. Report-Only shows exactly which ones.
Do I need to list every Google country domain?
For Google Ads and conversion features the guide says each top-level domain must be specified individually, so list the ones your traffic uses.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
