More in Getting started
- Install TapCub on your website
- Migrate from Google Analytics 4 or Baidu Tongji
- Add a website, app or mini-program
- How do I add TapCub to WordPress?
- How do I add TapCub to Shopify?
- Where do I paste the TapCub tracking code?
- Can I install TapCub with Google Tag Manager?
- How do I track a React, Vue or Next.js app?
- How do I check that TapCub is collecting data?
- Why does TapCub show no data after I installed it?
- What is a site, and how many can I add?
- Which time zone should I pick for a site?
- Which domains do I need to register?
- How do I keep my own visits out of the reports?
- Why does my visitor count differ from Google Analytics 4?
- Can I run TapCub alongside Google Analytics 4?
- How do I move my goals and events from GA4?
- Can I import my historical data from GA4?
- How do I add TapCub to Squarespace?
- How do I add TapCub to Wix?
- Do ad blockers block TapCub?
- How do I send events from my server?
- How do I install TapCub on React?
- How do I install TapCub on Nuxt?
- How do I install TapCub on Vue?
- How do I install TapCub on Next.js?
- How do I capture a HAR file for TapCub support?
- How do I create and manage API keys?
- How do I send events with the HTTP API?
- All guides in this category
Still have a question?
Could not find it? A person reads every message, usually within a few hours on business days.
Chat with usShort answer
Add the TapCub script host (https://static.pathclue.com in the Americas region) to script-src and the collect host (https://api.pathclue.com) to connect-src. Without connect-src, the script loads but sends nothing, with no error on the page.
The rules to add
A Content Security Policy (CSP) tells the browser which hosts a page may load scripts from and send data to. TapCub needs two:
| Directive | Host | Why |
|---|---|---|
script-src | https://static.pathclue.com | Loads the analytics script |
connect-src | https://api.pathclue.com | Sends pageviews and events |
For example:
script-src 'self' https://static.pathclue.com
connect-src 'self' https://api.pathclue.comThese are the hosts for the Americas region. Other regions use the same names with a region suffix, such as static-eu and api-eu. Use the host shown in your snippet on Web analyticsConfigurationSDK code.
Extensions such as identity, autocapture, errors and replay load from the same directory as the script, so the script-src rule covers them. If you also use live chat, it needs additional hosts listed in the developer docs.
How to tell CSP is blocking
- Realtime stays empty even though the snippet is in the page source.
- The browser console shows a CSP violation naming
script-srcorconnect-src. - The network panel shows no request to the collect host. When
connect-srcblocks it, the send fails silently and the page itself shows no error.
Adding the script host to script-src but forgetting connect-src is the most common mistake: the script loads, but nothing is sent.
Policies set in a meta tag or by a platform
The policy can come from a response header, a <meta http-equiv="Content-Security-Policy"> tag, a framework config or your hosting provider. Add the hosts wherever your policy is defined. If you use report-only mode first, check the reports for TapCub hosts before switching to enforcing.
Confirm it works
Reload the page, check the console for violations, then open Web analyticsRealtime. If the visit still does not appear, check that data is arriving.
See also: do ad blockers block TapCub and check your installation.
Did this answer your question?
We use your answers to fix and expand this page.
Couldn’t send. Please try again in a minute.
Thanks for the feedback. We’ll use it to improve this page.You’ve already sent feedback on this page. Thanks.