# Content Security Policy

Two directives let the script load from fiveb.ar and send its counts back.

If your site sends a Content Security Policy, in a `Content-Security-Policy` header or a `<meta http-equiv="Content-Security-Policy">` tag, it has to let the script load from fiveb.ar and send its counts back there. The [installation checker](https://fiveb.ar/docs/install/checker.md) reads your site’s policy and says whether it does, and what to change if not. Through a [proxy](https://fiveb.ar/docs/proxy.md), `'self'` is enough.

## The two directives

Add `https://fiveb.ar` to two directives:

- `script-src`, so the script can load. If the policy has `script-src-elem`, that decides instead, so add it there.
- `connect-src`, so the script can send. It uses `navigator.sendBeacon()`, falling back to `fetch()`, and `connect-src` governs both.

```
script-src 'self' https://fiveb.ar; connect-src 'self' https://fiveb.ar
```

The script runs no inline code and evaluates no strings, so it needs neither `'unsafe-inline'` nor `'unsafe-eval'`. A `Content-Security-Policy-Report-Only` header blocks nothing but reports what it would, so allow fiveb.ar there too before you enforce it.

## Policies that rely on default-src

A policy without one of those directives falls back to `default-src`. Don’t add fiveb.ar there: it would let fiveb.ar in for images, frames and everything else `default-src` covers. Add the two directives instead, each with what `default-src` allows plus fiveb.ar:

```
default-src 'self'; script-src 'self' https://fiveb.ar; connect-src 'self' https://fiveb.ar
```

## Nonces and strict-dynamic

With `'strict-dynamic'` in `script-src`, the browser ignores the addresses listed there and loads only scripts whose tag carries the page’s nonce. Give the tag the same `nonce` your server gives the page’s other scripts, fresh for each page:

```
<script async nonce="…" data-domain="example.com" src="https://fiveb.ar/js/tally.js"></script>
```

A tag added by a tag manager needs no nonce of its own, since `'strict-dynamic'` trusts the scripts a trusted script adds. `connect-src` still needs fiveb.ar.

---

fivebar is web analytics without cookies, at https://fiveb.ar. Every page of its docs is listed at https://fiveb.ar/docs/index.md.