Content security policy (CSP)

If your site sends a content security policy (Content-Security-Policy), it must allow two things towards the collection address (COLLECT_URL): loading the script, and sending data to it.

Content-Security-Policy:
  script-src 'self' https://stats.example.com;
  connect-src 'self' https://stats.example.com;

Directive	For
script-src	loading /a.js
connect-src	sends to /collect (fetch and navigator.sendBeacon)

Nothing else is needed: the script creates no style, image or frame, and does not use eval.

The inline bootstrap

The call queue before loading is an inline script. With a strict policy, give it the page’s nonce, or allow its hash:

<script nonce="{{ nonce }}">
  window.EodiaAnalytics = window.EodiaAnalytics || { q: [] };
  /* … */
</script>

Or put it in a file on your site, served from 'self'.

Preview mode

With data-preview, a page opened with #eodia-preview also loads /p.js, from the same collection address: the script-src directive above is enough. If eodia insights displays the page in a frame, the site’s frame-ancestors directive must allow the insights address:

Content-Security-Policy: frame-ancestors 'self' https://insights.example.com;

A collection subdomain

If collection is served from a subdomain of the site (stats.maison-arvor.fr as a CNAME), that is the one to allow. See the collection domain.