Content Security Policy (CSP)

How to configure your CSP to allow the Korvus snippet on your site.

What is a CSP?

A Content Security Policy is an HTTP header that tells the browser which domains are allowed to load scripts and send requests from your site. If your site uses a strict CSP, you need to add the Korvus domains to it.

If you don't know whether your site has a CSP, it most likely runs without one. Your developer can check your site's HTTP headers (DevTools → Network → click the page → Headers tab → look for Content-Security-Policy).

Directives to add

Whether you install Korvus through Google Tag Manager or directly in your HTML, two directives are required. The Korvus code loads its scripts from cdn.korvus.fr, even when GTM places it:

script-src https://cdn.korvus.fr;
connect-src https://app.korvus.fr;

• script-src allows the script to load from the Korvus CDN
• connect-src allows data to be sent to the Korvus API

Full example

If your current CSP looks like this:

Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com; connect-src 'self'

Add the Korvus domains:

Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com https://cdn.korvus.fr; connect-src 'self' https://app.korvus.fr

How to check

Method 1: browser console

Open your browser's DevTools (F12) and go to the Console tab. If the CSP is blocking Korvus, you will see a message like:

Refused to connect to 'https://app.korvus.fr/api/ingest' because it violates the following Content Security Policy directive: "connect-src 'self'"

Method 2: Network tab

In DevTools, go to the Network tab and look for requests to app.korvus.fr. If no request shows up even though the snippet has loaded, the CSP is probably blocking data from being sent.

Signs of a CSP block

• The snippet loads correctly (visible in Network)
• No data shows up in the Korvus dashboard
• Refused to connect or Refused to load the script errors appear in the console
• The snippet automatically detects the block and fails silently, with no impact on your site

Domains to allow

No other domain is needed. Korvus does not load third-party resources (no fonts, no images, no iframes).