# Getting CSP errors even after allowlisting Hubspot Tracking Code on web product **URL:** \ **Category:** APIs & Integrations\ **Tags:** sdk\ **Created:** [August 4, 2022, 1:33pm UTC](https://community.hubspot.com/t/getting-csp-errors-even-after-allowlisting-hubspot-tracking-code-on-web-product/62374 "2022-08-04T13:33:47Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![HBaranwal](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/hbaranwal/32/195989_2.png) [@HBaranwal](https://community.hubspot.com/u/HBaranwal)\ **Post date:** [August 4, 2022, 1:33pm UTC](https://community.hubspot.com/t/getting-csp-errors-even-after-allowlisting-hubspot-tracking-code-on-web-product/62374/1 "2022-08-04T13:33:47Z")
The problem we are facing when adding HubSpot scripts and functionality to our web product is that they are loaded from various domains and sub-domains. I have a CSP in place for security reasons, so all scripts, iframe, form, image sources, etc., need to be put on the allowlist before they’re loaded. I’m sure there’s a good reason why the scripts come from so many different domains, but every time we put one domain on the allowlist, it shows another domain on the network window while inspecting. Can I get a list of all possible domains/subdomains needed to allowlist to resolve the CSP error and track all the functionalities of the Hubspot script, or could someone tell me a workaround? As of right now, the process of allowlisting is full of friction. ---
**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\ **Post date:** [August 5, 2022, 5:02pm UTC](https://community.hubspot.com/t/getting-csp-errors-even-after-allowlisting-hubspot-tracking-code-on-web-product/62374/2 "2022-08-05T17:02:38Z")
Hi, @HBaranwal 👋 Welcome to the community. Hey, @himanshurauthan @JBeatty @miljkovicmisa have you ever solved for this or a similar issue? Thank you for taking a look! — Jaycee ---
**Author:** ![himanshurauthan](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/himanshurauthan/32/53076_2.png) [@himanshurauthan](https://community.hubspot.com/u/himanshurauthan)\ **Post date:** [August 31, 2022, 10:23am UTC](https://community.hubspot.com/t/getting-csp-errors-even-after-allowlisting-hubspot-tracking-code-on-web-product/62374/3 "2022-08-31T10:23:19Z")
Hello [@Jaycee\_Lewis](https://community.hubspot.com/t5/user/viewprofilepage/user-id/127074),thank you for tagging me in! Sure I would love to give it a try. So @HBaranwal I would suggest you try the following: **script-src** https://\*.hubspot.com [https://js.hscollectedforms.net](https://js.hscollectedforms.net/) [https://js.hsadspixel.net](https://js.hsadspixel.net/) https://\*.hs-scripts.com [https://js.hs-banner.com](https://js.hs-banner.com/) [https://js.hs-analytics.net](https://js.hs-analytics.net/) [https://forms.hsforms.com](https://forms.hsforms.com/) https://\*.usemessages.com **img-src** https://\*.hsforms.com https://\*.hubspot.com **connect-src** https://\*.hubspot.com https://\*.hubapi.com **frame-src** https://\*.hubspot.com I hope this will resolve your problem! Regards, ---
**Author:** ![THC](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/thc/32/13631_2.png) [@THC](https://community.hubspot.com/u/THC)\ **Post date:** [August 7, 2023, 6:18am UTC](https://community.hubspot.com/t/getting-csp-errors-even-after-allowlisting-hubspot-tracking-code-on-web-product/62374/4 "2023-08-07T06:18:56Z")
Hi @himanshurauthan , I hope you are doing well. I am facing a similar issue myself with the CSP header. My question is: how can we update the CSP header in the Domain security settings? Whenever I add the code to the CSP, my site throws errors and breaks. I want to narrow down the CSP to avoid broad issues in my domain. To achieve this, I need to add ‘object-src’ and ‘script-src’ directives to ‘self’, limiting the handling of objects and scripts to only those on my own domain, or specifying trusted domains. I’ve read and understood an [article](https://knowledge.hubspot.com/domains-and-urls/ssl-and-domain-security-in-hubspot) about setting up the CSP header, but it’s too confusing for me to implement on my domain. Could you please guide me through this issue? Your help would be greatly appreciated.