Google Tag Manager
Checked against the official docs on 2026-10-28. Official documentation (opens in a new tab)
Check Google Tag Manager against my policy
Google discourages the 'unsafe-inline' fallback. Tags fired by the container (analytics, ads, …) have their own requirements: check those vendors too.
The safer option: nonces
Add a per-response nonce to script-src-elem and use Google's nonce-aware container snippet. Tag Manager then passes the nonce on to every script it adds, so 'unsafe-inline' is not needed.
Load the container
script-src https://www.googletagmanager.com 'unsafe-inline';
img-src https://www.googletagmanager.com;
connect-src https://www.googletagmanager.com https://www.google.com;| Content | Allowed source | Why |
|---|---|---|
| Scripts | https://www.googletagmanager.com | Downloads the Tag Manager container script. |
| Inline code | 'unsafe-inline' | The container snippet is a small inline script (not needed with the nonce snippet). |
| Images | https://www.googletagmanager.com | Sends requests as image pixels. |
| Data connections | https://www.googletagmanager.comhttps://www.google.com | Sends requests to Google's servers. |
Custom JavaScript variables
Without it these variables evaluate to undefined. Google recommends Custom Templates instead.
script-src 'unsafe-eval';| Content | Allowed source | Why |
|---|---|---|
| Code from text (eval) | 'unsafe-eval' | Custom JavaScript variables are evaluated with eval(). |
Preview / debug mode
script-src https://www.googletagmanager.com https://tagmanager.google.com;
style-src https://www.googletagmanager.com https://tagmanager.google.com https://fonts.googleapis.com;
img-src https://www.googletagmanager.com https://ssl.gstatic.com https://www.gstatic.com;
font-src https://fonts.gstatic.com data:;| Content | Allowed source | Why |
|---|---|---|
| Scripts | https://www.googletagmanager.comhttps://tagmanager.google.com | Loads the preview panel scripts. |
| Styles | https://www.googletagmanager.comhttps://tagmanager.google.comhttps://fonts.googleapis.com | Loads the preview panel styles. |
| Images | https://www.googletagmanager.comhttps://ssl.gstatic.comhttps://www.gstatic.com | Loads the preview panel images. |
| Fonts | https://fonts.gstatic.comdata: | Loads the preview panel fonts. |
Something changed? Report an outdated entry (opens in a new tab).