Monitoring script

The Monitoring script is the core of Tapper's invalid traffic detection. It runs on every page of your website, analyzes visitor behavior in real time, and builds the invalid traffic lists your ad platforms use to exclude invalid traffic.

Step 1: Copy the script

Step 2: Add the script

Content security policy

If your website sends a Content-Security-Policy header, the browser refuses anything the policy does not name. The monitoring script then fails silently: nothing errors on your side and Tapper receives no visits. Some platforms enforce a policy by default: Magento 2.4.7 and later enforces one on the checkout page (the rest of a Magento storefront is report-only unless you change it). Add the entries below before you install.

Tapper shows the required entries under the monitoring script, in a box headed Content Security Policy, with its own copy button.

The list

This is the list Tapper tests in a real browser. Each line is a directive, a source and whether you need it. The table under it says what each entry is for.

script-src   https://monitor.tapper.ai         REQUIRED
connect-src  https://protect.tapper.ai         REQUIRED
connect-src  https://fingerprint.tapper.ai     REQUIRED
img-src      https://protect.tapper.ai         REQUIRED
worker-src   blob:                             REQUIRED
connect-src  https://m1.openfpcdn.io           OPTIONAL
script-src   'unsafe-inline'                   CONDITIONAL
script-src   https://www.googletagmanager.com  CONDITIONAL

About 'unsafe-inline': it weakens your policy's protection against injected scripts, and browsers ignore it when script-src also has a nonce, a hash or 'strict-dynamic'. On such a policy audiences cannot run, even with the entry added.

The audience entries cover only what Tapper injects. The ad platform's own script then calls its own hosts; follow Google's and Meta's CSP guidance for those. A site that already runs their ad tags already allows them.

Where each entry goes

• Add each source to the matching directive already in your policy. Do not paste the lines in as new directives, and do not send a second Content-Security-Policy header: browsers ignore a repeated directive, and a second header blocks everything it does not list.
• worker-src blob:: if your policy has no worker-src but has child-src, add blob: to child-src. If it has neither, add blob: to script-src, or add a worker-src directive that also keeps the sources your own workers need. Note that blob: in script-src also lets blob: scripts run.
• script-src entries: if your policy also sets script-src-elem, add them there too.
• connect-src and img-src: if the directive is missing, the browser uses default-src, so add the host there, or add the directive and repeat your default-src sources in it. A new directive stops default-src from applying, and your own requests would break.
• Nonce policies with 'strict-dynamic' ignore host lists in script-src. The script then loads only if whatever inserts it is trusted, for example GTM loaded with your nonce.
• Trusted Types (require-trusted-types-for 'script') is not supported.

Inline code and Google Tag Manager

The list assumes no inline code of Tapper's runs on your page. The monitoring script you copy from Tapper is an inline <script> block, and so is a GTM Custom HTML tag. Under a policy without 'unsafe-inline' in script-src, the browser refuses that block and the monitoring script is never even requested, whichever hosts you added. Pick one of these options:

• Your own script file, the option we recommend. Save the body of the snippet (the code between <script> and </script>) as a file on your own site, for example /js/tapper.js, and load it with <script src="/js/tapper.js"></script>. Your policy already allows your own origin ('self'), so there is nothing to add beyond the list.
• A nonce, on a manual HTML install only. Add your per-response nonce to the snippet's <script> tag. A GTM Custom HTML tag cannot carry a per-response nonce.
• A hash. Add the block's 'sha256-...' hash to script-src. The hash differs for every protected entity and changes if the block is edited at all.

The Tealium install is not affected: its extension code runs inside utag.js, not as an inline block.

Allowing https://www.googletagmanager.com lets the GTM container load. It does not allow the scripts GTM then injects: each of those still needs its own host in the policy (here https://monitor.tapper.ai), and inline Custom HTML tags need one of the options above.

Example header

Content-Security-Policy: script-src 'self' https://monitor.tapper.ai; connect-src 'self' https://protect.tapper.ai https://fingerprint.tapper.ai; img-src 'self' https://protect.tapper.ai; worker-src 'self' blob:

Merge these sources into your existing directives. Do not replace your policy with this line.

Magento

With Magento_Csp, add an etc/csp_whitelist.xml file to one of your modules:

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="tapper-monitor" type="host">https://monitor.tapper.ai</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="tapper-protect" type="host">https://protect.tapper.ai</value>
                <value id="tapper-fingerprint" type="host">https://fingerprint.tapper.ai</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="tapper-protect-img" type="host">https://protect.tapper.ai</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Then run bin/magento cache:flush.

• Worker entry: do not add a worker-src policy. Magento sets no worker-src, and its default child-src already allows blob:, so the worker passes. A worker-src policy would block your store's own workers. If your store removed blob: from child-src, restore the blob scheme under csp/policies/storefront/children/schemes in your config.
• Inline snippet: where the policy is enforced, allow the snippet by its hash inside the script-src policy, or use one of the other options above.

<value id="tapper-snippet" type="hash" algorithm="sha256">BASE64_HASH_OF_THE_SNIPPET_BODY</value>

• Audiences: csp_whitelist.xml accepts only hosts and hashes, so it cannot add 'unsafe-inline'. Magento 2.4.7 and later also turns off inline scripts on the checkout page on purpose, so Tapper audiences cannot run there.

Step 3: Verify

Next steps

• Install the conversion script on your confirmation page, or list your conversion pages instead.
• Choose your cookie policy and pass on your visitors' consent: see Consent and cookies.