# Content security policy headers when using Matomo or Google analytics

**URL:** <https://discourse.gohugo.io/t/content-security-policy-headers-when-using-matomo-or-google-analytics/22856>\
**Category:** tips & tricks\
**Created:** [January 17, 2020, 12:08pm UTC](https://discourse.gohugo.io/t/content-security-policy-headers-when-using-matomo-or-google-analytics/22856 "2020-01-17T12:08:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![frjo](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/frjo/32/18626_2.png) [@frjo](https://discourse.gohugo.io/u/frjo)\
**Post date:** [January 17, 2020, 12:08pm UTC](https://discourse.gohugo.io/t/content-security-policy-headers-when-using-matomo-or-google-analytics/22856/1 "2020-01-17T12:08:53Z")

</div>

I wrote a blog post [Content security policy headers when using Matomo or Google analytics](https://xdeb.org/post/2020/01/14/content-security-policy-headers-when-using-matomo-or-google-analytics/).

And have updated my [frjo/hugo-theme-zen](https://github.com/frjo/hugo-theme-zen) to not have inline code for Matomo analytic. The blog post describe how to do it for Google analytic as well.

> <https://github.com/frjo/hugo-theme-zen/blob/91106240a9375b941571842b718a9d41d9d4774e/assets/js/tracking.js#L6-L13>

> <https://github.com/frjo/hugo-theme-zen/blob/91106240a9375b941571842b718a9d41d9d4774e/layouts/partials/matomo.html#L1-L5>

There is some discussion around CSP and static sites here:

> [@Do you use Content Security Policy with your Hugo site?](https://discourse.gohugo.io/t/do-you-use-content-security-policy-with-your-hugo-site/20512):
>
> I’m using [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) on my static S3 hosted site to make it more secure. And, admittedly, hopefully get a SEO benefit too. slight_smile But it’s also a pain to maintain; it breaks when I for instance include some JavaScript. Then I have to whitelist resources, but then Google’s CSP Evaluator complains that it isn’t strict enough or that I shouldn’t whitelist jsdelivr.net because that site “is known to host Angular libraries which allow to bypass this CSP”. confused If it even …