Hotjar
Partially verified: the official docs list more than what we check today. Official documentation (opens in a new tab)
Check Hotjar against my policy
Based on Hotjar's default-src template. Hotjar also publishes a stricter per-directive template that is not captured here yet.
Tracking code
script-src https://*.hotjar.com 'unsafe-inline';
connect-src https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com;
img-src https://*.hotjar.com;
style-src 'unsafe-inline';| Content | Allowed source | Why |
|---|---|---|
| Scripts | https://*.hotjar.com | Loads the tracking script. |
| Inline code | 'unsafe-inline' | The tracking code is an inline snippet. |
| Data connections | https://*.hotjar.comhttps://*.hotjar.iowss://*.hotjar.com | Sends recordings and events (including over WebSocket). |
| Images | https://*.hotjar.com | Hotjar images. |
| Inline styles | 'unsafe-inline' | Survey and feedback widgets inject their styles. |
Something changed? Report an outdated entry (opens in a new tab).