mark/msos
0
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(csp): allow Cloudflare Web Analytics in Content-Security-Policy

Browse Source 
The enforced CSP blocked the Cloudflare beacon, so Web Analytics wasn't
collecting anything on the live site. Add https://static.cloudflareinsights.com
to script-src (loads beacon.min.js) and https://cloudflareinsights.com to
connect-src (RUM data POST). Also documented that re-enabling the Preferred
Sources pill will need https://news.google.com in the CSP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
popovskikandClaude Opus 4.8 committed 2026-08-30 15:40:34 +02:00
1 parent 44c6f2c417
commit 6323d55718
2 files changed
+7 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.htaccess
+1 -1
View File
@@ -105,7 +105,7 @@ Options -Indexes
# host allowlists still constrain where scripts load from and where data can
# be sent (connect/form-action/base-uri/object-src), which is the real value
# here on top of the site's existing output escaping.
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://assets.mailerlite.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://www.googletagmanager.com https://docs.google.com https://assets.mailerlite.com; frame-src https://www.youtube-nocookie.com https://www.youtube.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://docs.google.com; object-src 'none'"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://assets.mailerlite.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://www.googletagmanager.com https://docs.google.com https://assets.mailerlite.com https://cloudflareinsights.com; frame-src https://www.youtube-nocookie.com https://www.youtube.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://docs.google.com; object-src 'none'"
<FilesMatch "\.html$">
Header set Cache-Control "no-cache, must-revalidate"
</FilesMatch>