# Problem with CSP

**URL:** <https://community.piwik.pro/t/problem-with-csp/2645>\
**Category:** Data collection and tags\
**Created:** [July 26, 2023, 9:36am UTC](https://community.piwik.pro/t/problem-with-csp/2645 "2023-07-26T09:36:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![KHJA](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/khja/32/2168_2.png) [@KHJA](https://community.piwik.pro/u/KHJA)\
**Post date:** [July 26, 2023, 9:36am UTC](https://community.piwik.pro/t/problem-with-csp/2645/1 "2023-07-26T09:36:25Z")

</div>

Hi @Admin,

We are currently implementing a like-wise CSP header and have the exact same issue on our server end when trying to implement the piwik pro script.

The script-src looks like this:

script-src-elem ‘self’ [https://CLIENT.containers.piwik.pro](https://CLIENT.containers.piwik.pro) [https://CLIENT.piwik.pro/ppms.js](https://CLIENT.piwik.pro/ppms.js) ‘nonce-VALUE’;\

The error message in our browser log:

“Refused to execute inline script because it violates the following Content Security Policy directive: …”

We do not face issues when tracking on localhost.

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\
**Post date:** [July 26, 2023, 9:38am UTC](https://community.piwik.pro/t/problem-with-csp/2645/2 "2023-07-26T09:38:47Z")

</div>

Hi. Did you follow this guide? [Content Security Policy (CSP) — Piwik PRO Analytics Suite 17.6 documentation](https://developers.piwik.pro/en/latest/tag_manager/content_security_policy.html)

---

<div class="post-metadata">

**Author:** ![KHJA](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/khja/32/2168_2.png) [@KHJA](https://community.piwik.pro/u/KHJA)\
**Post date:** [July 26, 2023, 9:59am UTC](https://community.piwik.pro/t/problem-with-csp/2645/3 "2023-07-26T09:59:30Z")

</div>

Thank you for your quick response @Admin

After checking the documentation and updating the script to the async snippet, we still face the same error when testing on our not-local environment.

---

<div class="post-metadata">

**Author:** ![sararekowska](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/sararekowska/32/1582_2.png) [@sararekowska](https://community.piwik.pro/u/sararekowska)\
**Post date:** [July 26, 2023, 12:48pm UTC](https://community.piwik.pro/t/problem-with-csp/2645/4 "2023-07-26T12:48:58Z")

</div>

Hi!  
Could you provide us with the URL of the instance you are referring to? You can leave it here under the thread or send it to me via private message.