ConversionRuler Content Security Policy for Installations - Revision history

Admin at 19:51, 4 February 2026

2026-02-04T19:51:10Z

Admin at 19:25, 4 February 2026

2026-02-04T19:25:18Z

Admin: Created page with "For sites which have Content Security Policy (or CSP) headers enabled for more advanced security. Your web server administrator will need to configure your web server..."

2026-02-04T19:18:10Z

Created page with "For sites which have Content Security Policy (or CSP) headers enabled for more advanced security. Your web server administrator will need to configure your web server..."

New page

For sites which have [[Content Security Policy]] (or [[CSP]]) headers enabled for more advanced security.

Your web server administrator will need to configure your web server to add ConversionRuler's domains to the `Content-Security-Policy` headers for your site to enable ConversionRuler to communicate with the tracking servers.

ConversionRuler requires the following permissions:

* <code>script-src</code> for loading our report script
* <code>connect-src</code> for tracking
* <code>img-src</code> for image tracking (alternate method)

An example Content Security Policy header looks like:

Content-Security-Policy: default-src 'self'; connect-src 'self' *.ruler.to *.conversionruler.com; frame-ancestors 'self'; frame-src 'self'; img-src * data:; media-src 'self' data: blob:; object-src 'none'; script-src 'strict-dynamic' 'self' *.ruler.to *.conversionruler.com blob:; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com; worker-src 'self' blob:;

Which formatted a little more clearly is:

default-src 'self';
connect-src 'self' *.ruler.to *.conversionruler.com;
frame-ancestors 'self';
frame-src 'self';
img-src * data:;
media-src 'self'
data: blob:;
object-src 'none';
script-src 'strict-dynamic' 'self' *.ruler.to *.conversionruler.com blob:;
style-src 'self' 'unsafe-inline' cdn.example.com;
worker-src 'self' blob:;

Techniques to add this to your web server configuration are beyond the scope of this article but searching for '''Custom HTTP headers''' in your web server or web server provider's documentation should provide information on how to configure this header.

[[Category:ConversionRuler Installation]]

@@ Line 1: / Line 1: @@
 For sites which have [[Content Security Policy]] (or [[CSP]]) headers enabled for more advanced security.
-Your web server administrator will need to configure your web server to add ConversionRuler's domains to the `Content-Security-Policy` headers for your site to enable ConversionRuler to communicate with the tracking servers.
+Your web server administrator will need to configure your web server to add our tracking domains to the `Content-Security-Policy` headers for your site to enable our code to communicate with the our servers.
-ConversionRuler requires the following permissions:
+ConversionRuler installations require the following permissions:
 * <code>script-src</code> for loading our report script
@@ Line 22: / Line 22: @@
 Which formatted a little more clearly is:
-  default-src 'self';
+  Content-Security-Policy:
- connect-src 'self' *.ruler.to *.conversionruler.com;
+   default-src 'self';
- frame-ancestors 'self';
+   connect-src 'self' *.ruler.to *.conversionruler.com;
- frame-src 'self';
+   frame-ancestors 'self';
- img-src * data:;
+   frame-src 'self';
- media-src 'self'
+   img-src * data:;
- data: blob:;
+   media-src 'self'
- object-src 'none';
+   data: blob:;
- script-src 'strict-dynamic' 'self' *.ruler.to *.conversionruler.com blob:;
+   object-src 'none';
- style-src 'self' 'unsafe-inline' cdn.example.com;
+   script-src 'strict-dynamic' 'self' *.ruler.to *.conversionruler.com blob:;
- worker-src 'self' blob:;
+   style-src 'self' 'unsafe-inline' cdn.example.com;
 Techniques to add this to your web server configuration are beyond the scope of this article but searching for '''Custom HTTP headers''' in your web server or web server provider's documentation should provide information on how to configure this header.
 [[Category:ConversionRuler Installation]]

@@ Line 8: / Line 8: @@
 * <code>connect-src</code> for tracking
 * <code>img-src</code> for image tracking (alternate method)
 An example Content Security Policy header looks like: