Allow Tapper in your Content Security Policy

If the monitoring script is installed, even firing in Google Tag Manager, but Tapper shows no visits or a high failed script load rate, your site's Content Security Policy (CSP) may be blocking it.

Why it happens

A CSP tells the browser where scripts, images and connections may come from, and refuses anything else. If Tapper's hosts are not on it, every browser refuses the monitoring script. The tag still fires in Google Tag Manager, but Tapper never receives the visit.

Confirm it is the policy

1. Open your website in Chrome.
2. Open DevTools (right-click the page and choose Inspect).
3. On the Console tab, look for "Refused to load the script" naming https://monitor.tapper.ai/bundle.js and saying it "violates the following Content Security Policy directive". If the policy refuses the script's inline code, the message starts "Refused to execute inline script".
4. On the Network tab, filter on tapper and reload. A blocked bundle.js request from monitor.tapper.ai points to the policy.

If you see either, change your policy, not the Tapper install.

Fix it

The sources are in Setup > Website > Monitoring, on the Install script and consent tab, in the Content Security Policy box under the monitoring script. Its copy button gives your developer the exact list.

Every site with a policy needs these, one directive per line:

script-src   https://monitor.tapper.ai
connect-src  https://protect.tapper.ai https://fingerprint.tapper.ai
img-src      https://protect.tapper.ai
worker-src   blob:

Merge them into your existing policy:

• Add each source to the matching directive you already have. Do not add new directives or a second Content-Security-Policy header: browsers ignore a repeated directive, and a second header blocks everything it does not list.
• No connect-src or img-src? Add those sources to default-src.
• Add blob: to worker-src if your policy has it, otherwise to child-src, otherwise to script-src.
• If you have script-src-elem, add https://monitor.tapper.ai there too.
• The monitoring script is inline code, in your page or a Google Tag Manager Custom HTML tag. If your script-src lacks 'unsafe-inline', or uses a nonce or hash, browsers refuse it. Add your nonce to its <script> tag or its sha256 hash to script-src, or load https://monitor.tapper.ai/bundle.js from your own script file and call tapper.init there.
• Policies using 'strict-dynamic' or Trusted Types are not covered by this list.

Not in the box

• connect-src https://m1.openfpcdn.io is optional, and the app recommends leaving it out.
• Only if you use Tapper audiences: script-src 'unsafe-inline', plus script-src https://www.googletagmanager.com for Google Ads audiences. Sites that run those ad tags usually allow both.

If it still happens

• Reload your site and check the Console again. A new "Refused to" message names the directive that still needs a source.
• Then check that the monitoring script is working.
• Not sure where your policy is set? Forward this article to your developer or security team, or write to support@tapper.ai.

Related

• The monitoring script: what it does and where to find it
• Install the monitoring script with Google Tag Manager
• Does the monitoring script slow down my website?
• No clicks on the dashboard: what to check