# Bug: Content Security Policy problems

**URL:** <https://community.hubspot.com/t/bug-content-security-policy-problems/11772>\
**Category:** APIs & Integrations\
**Tags:** events\
**Created:** [March 9, 2018, 7:24am UTC](https://community.hubspot.com/t/bug-content-security-policy-problems/11772 "2018-03-09T07:24:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kunambi](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/kunambi/32/53869_2.png) [@Kunambi](https://community.hubspot.com/u/Kunambi)\
**Post date:** [March 9, 2018, 7:24am UTC](https://community.hubspot.com/t/bug-content-security-policy-problems/11772/1 "2018-03-09T07:24:14Z")

</div>

# CSP: Content Security Policy

## Problem:

Embedding Javascript tracking on our website is blocked by CSP policies.

## Current setup:

Our servers current CSP policy includes `https://js.hs-scripts.com` and `https://js.hs-analytics.net`.

## Recreate problem:

- Embed the Javascript on the website, e.g: `<script type="text/javascript" id="hs-script-loader" async defer src="https://js.hs-scripts.com/NNNNNNN.js"></script>`
- When loading the webpage, an error is printed in the console: `Loading failed for the <script> with source “http://js.hs-analytics.net/analytics/XXXXXXXXXXXXX/NNNNNNN.js”.`

Our CSP policy refuses connection to unsafe http sources.

- When we instead try to directly embed the resource, e.g: `<script type="text/javascript" id="hs-script-loader" async defer src="https://js.hs-analytics.net/analytics/XXXXXXXXXXXXX/NNNNNNN.js.js"></script>`
- When loading the webpage, an error is printed in the console: `Content Security Policy: The page’s settings blocked the loading of a resource at http://track.hubspot.com/__ptq.gif?abcxyz...` (GET-param redacted for privacy reasons)

The connection fails again due to our CSP policy to refuse connection to unsafe http sources.

## Suggested solution:

Please make sure to include **https** -resources, _at all times_.

Sincerely,  
kunambi

---

<div class="post-metadata">

**Author:** ![Kunambi](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/kunambi/32/53869_2.png) [@Kunambi](https://community.hubspot.com/u/Kunambi)\
**Post date:** [March 9, 2018, 8:17am UTC](https://community.hubspot.com/t/bug-content-security-policy-problems/11772/2 "2018-03-09T08:17:18Z")

</div>

We realized that this happened because our staging server didn’t run on HTTPS. Running your scripts over HTTPS does not create these problems.

However, I still suggest that you should always load your resources over HTTPS.

Will let this post remain, in case anyone else has the same issue.

Thanks,  
kunambi