Optimizely Web Experimentation

Checked against the official docs on 2026-10-28. Official documentation (opens in a new tab)

Check Optimizely Web Experimentation against my policy

Cross-domain targeting needs frame-src https://a<account-id>.cdn.optimizely.com (and https://a<account-id>.cdn-pci.optimizely.com with PCI). These depend on your account ID and are not checked here.

The safer option: nonces

Put a nonce on the snippet script tag and use 'nonce-…' 'strict-dynamic' in script-src. Browsers that support 'strict-dynamic' then only need the nonce.

Client script, preview and geotargeting

script-src 'self' https://*.optimizely.com https://optimizely.s3.amazonaws.com https://cdn-assets-prod.s3.amazonaws.com;
connect-src https://logx.optimizely.com https://*.optimizely.com;
img-src https://cdn.optimizely.com;
style-src https://*.optimizely.com 'unsafe-inline';

Content	Allowed source	Why
Scripts	`'self'https://*.optimizely.comhttps://optimizely.s3.amazonaws.comhttps://cdn-assets-prod.s3.amazonaws.com`	Loads the client script, the preview client and geotargeting.
Data connections	`https://logx.optimizely.comhttps://*.optimizely.com`	Logs events.
Images	`https://cdn.optimizely.com`	Loads images uploaded through the Visual Editor.
Styles	`https://*.optimizely.com`	Experiment CSS changes.
Inline styles	`'unsafe-inline'`	Experiment CSS changes are injected inline.

Audiences with custom JavaScript conditions

script-src 'unsafe-eval';

Content	Allowed source	Why
Code from text (eval)	`'unsafe-eval'`	Custom JavaScript conditions are evaluated with eval().

Something changed? Report an outdated entry (opens in a new tab).