Content Security Policy blocks some resources
A Content Security Policy is a site setting that lists where scripts and requests may come from. Google says this one does not list the addresses the Google tag needs, so the tag may fail to load or send data. Check the tag in Tag Assistant to see which address is refused. Then ask whoever controls the site's headers to allow that address, and retest.
At a glance
- Where it shows
- The Diagnostics tab in the Google tag settings, under Tag quality.
- What stops
- Measurement from the tag that is refused. Nothing on the visible page shows an error, so the first sign is a gap in the reports.
- How serious
- Medium. Conversions and remarketing from the affected pages stop being counted, and bids run on the data that is missing.
What it means
A Content Security Policy is a rule the site sends to the browser that says which addresses its scripts and requests may use. Google's message says the site's policy does not list the addresses the Google tag needs, so the browser can refuse to load the tag or stop it from sending data.
The message is about permission, not about the tag's code. The tag can be installed correctly and still be refused by the browser, because the site's policy is stricter than the tag expects. That is why the container looks right while the reports are empty.
What actually triggers it
A policy copied from an older setup
Not on Google's help page
A policy copied from a template, a security plugin or an earlier version of the site lists the addresses that were needed then. A tag added later calls an address the list does not include.
A tag added after the policy was written
Not on Google's help page
The policy was set before the Google tag went in, so nobody checked the tag's addresses against it. Nothing on the page shows the refusal.
A security update that tightens the policy site-wide
Not on Google's help page
A tightened policy blocks the tag on every page at once, not on one page. The first sign is a drop in what the reports show, not a page error.
Fix it in this order
- Open the Diagnostics tab in the Google tag settings and read the message.
- Run Google Tag Assistant on an affected page and find the Google measurement request that is refused. The blocked address comes from that test, not from guessing at the policy.
- Ask whoever controls the site's headers or security setup to allow the refused Google measurement addresses. Google's fix is to update the policy, not a setting in the ad account.
- Reload the page in Tag Assistant to confirm the request now goes through, then check the Diagnostics tab again.
If the message stays after the policy changes, the address the test names is still missing. Run the test again instead of widening the policy beyond the addresses it names.
Often confused with
Google tag has stopped sending data
A tag that was working and stopped. It is marked Urgent after 48 hours without data and names no cause. This message names a policy that blocks the tag's resources, so start with the policy.
Event tags with no base Google tag in the container. Nothing is blocked in that case, so the policy is not the cause.