AB Tasty
Checked against the official docs on 2026-10-28. Official documentation (opens in a new tab)
Check AB Tasty against my policy
The editor uses the tag, so allowing the editor's requirements also covers the tag. A developer-portal version of the same page lists narrower hosts; this entry follows docs.abtasty.com.
The safer option: nonces
Add 'nonce-…' and 'strict-dynamic' to script-src and put the same nonce attribute on the tag's script element. With a nonce, 'unsafe-inline' is no longer required.
Tag (run campaigns)
script-src *.abtasty.com 'unsafe-inline';
frame-src 'self';
connect-src *.abtasty.com;
style-src *.abtasty.com 'unsafe-inline';
img-src *.abtasty.com;| Content | Allowed source | Why |
|---|---|---|
| Scripts | *.abtasty.com | Loads the tag and campaign code. |
| Inline code | 'unsafe-inline' | Campaign code runs inline (not needed with a nonce). |
| Embedded frames | 'self' | Uses frames on your own domain. |
| Data connections | *.abtasty.com | Sends visitor data and campaign events. |
| Styles | *.abtasty.com | Loads campaign styles. |
| Inline styles | 'unsafe-inline' | Campaigns inject styles to change the page. |
| Images | *.abtasty.com | Loads campaign images. |
Visual editor
script-src blob: *.abtasty.com;
frame-src 'self';
connect-src *.abtasty.com;
img-src *.abtasty.com;
style-src *.abtasty.com;
font-src *.abtasty.com;| Content | Allowed source | Why |
|---|---|---|
| Scripts | blob:*.abtasty.com | The editor runs scripts created on the fly. |
| Embedded frames | 'self' | Uses frames on your own domain. |
| Data connections | *.abtasty.com | Talks to the AB Tasty app. |
| Images | *.abtasty.com | Loads editor images. |
| Styles | *.abtasty.com | Loads editor styles. |
| Fonts | *.abtasty.com | Loads editor fonts. |
Something changed? Report an outdated entry (opens in a new tab).