hotjar script blocked csp violation not loading error

Fix Hotjar script blocked by CSP violation and not loading

TL;DR

Hotjar fails to load when your Content Security Policy does not allow its domains. Add the Hotjar script, connect, and font sources to your CSP directives and redeploy. The policy is doing its job; it just does not know Hotjar is invited.

The error

Hotjar not loading
Refused to load the script because it violates the Content Security Policy directive.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=hotjar script blocked csp violation not loading error"

Fix it

Step 1: Read the exact CSP violation

Open the browser console and copy the violated directive and the blocked URL.

Expected: You know which directive blocked which Hotjar domain.

Step 2: Add Hotjar domains to your CSP

Extend script-src, connect-src, and related directives with the Hotjar domains from their docs.

Expected: The policy now permits Hotjar's sources.

Step 3: Redeploy the policy

Ship the updated CSP header or meta tag.

Expected: The new policy is live; verify in the response headers.

Step 4: Reload and check the console

Reload the page and watch for CSP errors.

Expected: No violations; the Hotjar script loads.

Step 5: Verify recordings and heatmaps

Check the Hotjar dashboard for incoming data.

Expected: Sessions and heatmaps start populating.

When this applies

• Hotjar fails to load with CSP violations
• The snippet works without CSP but not with it
• You just tightened the Content Security Policy

When it doesn't

• Hotjar loads but records nothing (check the site settings)
• The error is an adblocker block (different cause)
• You have no CSP and it still fails (check the snippet install)

Compatibility

Hotjar tracking snippet. Any CSP implementation.

Variant phrasings

hotjar csp refused to load script

Same violation. The console names the directive; extend exactly that one.

hotjar blocked content security policy

Hotjar needs several directives, not just script-src. Check their current CSP docs.

hotjar not working strict csp

Strict policies need explicit entries for every Hotjar subdomain. Wildcards may not cover them.

Why it happens

Content Security Policy blocks any resource not explicitly allowed, and Hotjar loads scripts, sends beacons, and pulls assets from its own domains. A CSP written before Hotjar was added, or tightened later, blocks all of it. The fix is allow-listing, not disabling the policy.

Edge cases

• CSP reports via report-uri help you find every blocked domain before users do
• Meta-tag CSPs cannot use some directives; prefer the header form
• Staging and prod CSPs often differ; test the policy in the environment that matters

If it still fails

• Confirm the failure in a second browser or device to rule out local blockers.
• Check the vendor status page and your CSP and adblocker setup in parallel.
• Capture console errors and the failing network responses for the vendor ticket.
• Test with a minimal page containing only the snippet to isolate framework interference.
• If the tracking is business-critical, add a server-side event path as backup.

Prevention

• Pin snippet versions and test upgrades in staging first.
• Run CSP in report mode before enforcing, so new vendors surface early.
• Monitor event volume per source; sudden drops are the early warning.
• Keep a server-side backup path for business-critical events.
• Document which env vars each snippet needs so deploys never miss one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Y0qGuqBTbq1qdDbV-CHWUQ

Resolved from the public thread: https://vectle.com/posts/pst_Y0qGuqBTbq1qdDbV-CHWUQ

Thread query: hotjar script blocked csp violation not loading error

TL;DR: Hotjar fails to load when your Content Security Policy does not allow its domains. Add the Hotjar script, connect, and font sources to your CSP directives and redeploy. The policy is doing its job; it just does not know Hotjar is invited.