CSP Settings

Last updated: August 31, 2026

CSP Settings for Vector

Depending on your organization's security requirements, you may need to update your Content Security Policy (CSP) to allow Vector's Pixel to load and communicate with Vector's services.

If your website already uses a CSP, add the Vector domains below to your existing policy.

⚠ Important: Do not replace your existing CSP with the configuration below. Add the required sources to your current policy. If a directive already exists, add the Vector domains to it instead of creating a second directive.

Add Vector to your CSP

Add the following sources to your existing CSP:

Directive

Add

script-src

https://cdn.vector.co https://a.usbrowserspeed.com

connect-src

https://api.vector.co

frame-src

https://api.vector.co

img-src

https://api.vector.co

What each directive does

  • script-src allows the Vector Pixel to load from Vector's CDN.

  • connect-src allows the Pixel to send requests to Vector's API.

  • frame-src allows Vector to load the resources required for identity enrichment.

  • img-src allows resources required for identity enrichment to load.

💡 Security recommendation: Use the exact Vector hosts listed above. Avoid using a wildcard such as https://*.vector.co unless your organization's security requirements specifically require it. A wildcard allows access to additional Vector subdomains that aren't required for the Pixel.

Example CSP

If your website already has a CSP, merge the Vector sources into the appropriate directives.

Content-Security-Policy: script-src 'self' https://cdn.vector.co https://a.usbrowserspeed.com; connect-src 'self' https://api.vector.co; frame-src 'self' https://api.vector.co; img-src 'self' https://api.vector.co

Your existing CSP may contain many additional directives and sources. The example above only shows where the Vector domains need to be added.

How to verify your CSP

After updating your CSP, load your website and check the browser's developer tools.

  1. Open your website.

  2. Open Developer Tools in your browser.

  3. Open the Console tab.

  4. Reload the page.

  5. Look for messages containing Content Security Policy, CSP, or blocked.

If the CSP is blocking Vector, the browser will usually show which resource was blocked and which directive caused the block.

💡 Tip: Test the page in an incognito/private window when troubleshooting Pixel issues. This can help rule out browser extensions or cached resources affecting your test.