From 5e3c61846bf5228e6467ca99a1efe577e361310d Mon Sep 17 00:00:00 2001
From: Anjo Vahldiek-Oberwagner <anjovahldiek@gmail.com>
Date: Tue, 23 Jun 2026 12:58:31 +0200
Subject: [PATCH] fix: allow Google Analytics in Content Security Policy

Add https://www.googletagmanager.com to script-src and
https://www.google-analytics.com, https://analytics.google.com,
https://www.googletagmanager.com to connect-src so that the
GA gtag script set via jekyll google_analytics config loads
without CSP violations.
---
 src/_includes/head/custom.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/_includes/head/custom.html b/src/_includes/head/custom.html
index 48af5c3..612987e 100644
--- a/src/_includes/head/custom.html
+++ b/src/_includes/head/custom.html
@@ -36,11 +36,11 @@
      Note: unsafe-eval is required by Alpine.js for expression evaluation. -->
 <meta http-equiv="Content-Security-Policy"
       content="default-src 'self';
-               script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net;
+               script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://www.googletagmanager.com;
                style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com;
                font-src 'self' https://cdn.jsdelivr.net https://fonts.gstatic.com data:;
                img-src 'self' data: https:;
-               connect-src 'self' https://cdn.jsdelivr.net;
+               connect-src 'self' https://cdn.jsdelivr.net https://www.google-analytics.com https://analytics.google.com https://www.googletagmanager.com;
                object-src 'none';
                base-uri 'self';
                form-action 'self'">