Google Tag Manager is not starting after being downloaded

[juicygoose]

Hi everyone,

I am facing an issue that I start having difficulties troubleshooting !
I have installed Google Tag Manager on my doks site by adding
{{ block "head/gtm" . }}{{ partial "head/gtm.html" . }}{{ end }} in the partials/head/head.html with gtm.html having the following content:

<link rel="dns-prefetch" href='https://www.googletagmanager.com'>
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
	new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
	j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
	'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
	})(window,document,'script','dataLayer','GTM-XXX');</script>

I have also added the iframe in baseof.html right after opening :

    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WXDG96B"
      height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>

Now I have updated my CSP policy to allow the different sources and I don't have any more CSP related console errors when loading my website hosted on netlify.
The Tag manager is downloaded and started in my local dev env but when hosted on netlify it's only downloaded and never started...

I tried disabling CSP headers, removing them, but I think the problem is somewhere else.

Thanks a lot in advance for your help !

[h-enk]

Can you provide a repo a/o url to the live site?

[juicygoose]

Hey,

Here is the actual code https://github.com/juicygoose/doks/tree/main/layouts/partials/head
And the live site https://ressources.yalink.fr/blog/

Thanks a ton,
I also want to thank you for this awesome theme

Have a beautiful day,
A

[h-enk]

Console errors — using Web Developer Tools:

Generated CSP configuration using Laboratory (see also Content Security Policy):

Consider using the generated CSP configuration:

default-src 'none'; connect-src https://client.axept.io/60ae5e896cd349769a803843.json; font-src 'self'; img-src 'self' https://axeptio.imgix.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://static.axept.io/sdk.js https://www.googletagmanager.com/gtm.js; style-src 'self' 'unsafe-inline' 

Or. look further into it, and make it safer — my recommendation.

See also: Using Google Tag Manager with a Content Security Policy

[juicygoose]

Thanks for the detailed answer, I will dig more into that. Weird that I didn't get all the CSP errors on Brave..

Have a beautiful day,
A