Contentsquare

Partially verified: the official docs list more than what we check today. Official documentation (opens in a new tab)

The official page also documents img-src tracking subdomains, blob: workers (child-src / worker-src) and csxd. frames for cross-domain tracking. Those are not captured here yet.

Experience Analytics

script-src *.contentsquare.net app.contentsquare.com 'unsafe-inline';
connect-src *.contentsquare.net *.contentsquare.com;
style-src app.contentsquare.com;

Content	Allowed source	Why
Scripts	`*.contentsquare.netapp.contentsquare.com`	Loads the tag (from t.contentsquare.net) and zoning from the app.
Inline code	`'unsafe-inline'`	The tag is usually started by a small inline script.
Data connections	`.contentsquare.net.contentsquare.com`	Sends data.
Styles	`app.contentsquare.com`	Styles for in-page zoning.

Voice of Customer

style-src 'unsafe-inline';

Content	Allowed source	Why
Inline styles	`'unsafe-inline'`	Survey widgets inject their styles.

Something changed? Report an outdated entry (opens in a new tab).