From the organizer dashboard, you can enable security protection, which adds a stricter CSP (Content-Security-Policy) setting to your webpage's header.
We use a nonce-based approach — each time the page loads, a dynamic variable is generated and passed into your GTM. If you have your own GTM installed, before turning on CSP you'll need to add this nonce in GTM and modify your custom JavaScript to match our setup.
Please follow the steps below
In GTM, add a new JavaScript variable and name it nonceForCSP
Add this nonce to every custom Custom HTML tag
Using the Facebook tracking tag as an example
Add the nonce, with the syntax below
<script nonce="{{nonceForCSP}}">Under Advanced Settings, check "Support document.write"
If you're installing a tag provided directly by a third-party service and can't modify the script, you can instead add that tracking tag's domain to our dashboard — just enter these domains under external resource domains.
If you plan to embed our promo plugin on your own website, enter your website's URL in the "Embed promo domain" field.
