What is a Content-Security-Policy?

It's a list your website gives to every visitor's browser, saying which places the page is allowed to use content from. Anything not on the list is refused.

script-src 'self' https://www.googletagmanager.com;

img-src 'self' data:;

Line 1: code (scripts) may only come from our own website and from Google Tag Manager.
Line 2: images may only come from our own website, or be embedded directly in the page.

Why websites have one

A web page is assembled from many pieces: your own code, but also scripts from analytics, advertising, chat or testing tools. If an attacker manages to slip their own script into a page, for example through a vulnerable plugin or a compromised supplier, that script can read what visitors type, including passwords and card numbers. Attacks like this have hit well-known retailers and airlines.

The policy is a safety net: even if malicious code gets in, the browser refuses to run it or to send data to places that aren't on the list. For sites that take payments, standards such as PCI DSS now expect this kind of control.

Why it blocks marketing tools

From the browser's point of view, a new analytics tag or A/B testing tool is just more code coming from a new place. If that place isn't on the list, it's blocked, exactly like an attack would be. The browser can't tell a tool you chose from a malicious one: only the list can.

So adding a tool usually means adding its addresses to the list. Most vendors publish exactly what to add. Some also ask for permissions that loosen the protection for everyone, like allowing code written directly in the page ('unsafe-inline'). That's where your security team may push back, and that's a reasonable conversation, not a refusal.

Words you'll hear

Directive: One rule of the policy, for one kind of content: script-src for code, img-src for images, and so on.
Source: An allowed place in a rule: a website address, or a keyword like 'self' (your own site).
'unsafe-inline': Allows code written directly inside the page. Many marketing tools need it; it also weakens the protection the most.
Nonce: A secret one-time code the site puts on the scripts it trusts. It's the modern, safer alternative to 'unsafe-inline', and most tag managers support it.
Report-only: A trial mode: the browser reports what it would block, but blocks nothing. Teams use it to test a policy safely.

How to ask for a change

Find your site's current policy.
Paste it into the analyzer and pick the tools you want to use.
Copy the message it writes for your IT or security team. It lists exactly what to add, why, and the risks to weigh.