CSP for Google services, the host cheat sheet

Google services are some of the most common things a Content Security Policy (CSP) breaks, because each one loads from its own set of hosts and trips a different directive. The temptation is to widen the whole policy until the breakage stops, which quietly undoes the protection. This is a per-service cheat sheet instead: the specific directives each service needs, so you add exactly what is required and nothing more.

Add these in Report-Only first, confirm nothing else breaks, then enforce. For Analytics and Tag Manager specifically, see the dedicated CSP for Google Analytics and Tag Manager post, which covers the nonce details those need.

The host lists below are a starting point, not gospel. Google changes hosts over time, and your exact set depends on which features you enable. Confirm the real hosts for your own site with a scan rather than copying a static list blind.

Google Fonts

Google Fonts loads in two stages: a stylesheet from one host, then the font files it references from another. You need both directives or the text falls back to a system font.

Content-Security-Policy:
    style-src 'self' https://fonts.googleapis.com;
    font-src 'self' https://fonts.gstatic.com

Google Maps

The Google Maps JavaScript API is heavier: it loads its JavaScript, fetches map tiles as images, and makes API calls for geocoding and directions. That touches three directives.

Content-Security-Policy:
    script-src 'self' https://maps.googleapis.com;
    img-src 'self' https://maps.gstatic.com https://*.googleapis.com https://*.ggpht.com data:;
    connect-src 'self' https://maps.googleapis.com

The wildcards on img-src cover the tile hosts that plain maps.gstatic.com misses: Street View tiles come from geo*.ggpht.com and satellite tiles from khms*.googleapis.com, which *.ggpht.com and *.googleapis.com allow. Google's Maps JavaScript API CSP guide lists this exact set.

reCAPTCHA

reCAPTCHA loads a script from Google and renders its challenge inside a frame, so it needs both script-src and frame-src. The reCAPTCHA CSP guidance scopes these to the /recaptcha/ path rather than the whole host:

Content-Security-Policy:
    script-src 'self' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
    frame-src https://www.google.com/recaptcha/

If a network or region blocks www.google.com, Google documents www.recaptcha.net as the alternate host. Load the reCAPTCHA library from www.recaptcha.net and swap every www.google.com/recaptcha/ reference to www.recaptcha.net/recaptcha/ at the same time, in both script-src and frame-src, so the script origin and the frame origin stay in sync.

YouTube embeds

An embedded YouTube player runs in an iframe, and the poster thumbnails load as images, so you need frame-src for the player and img-src for the thumbnails. Google does not publish a single canonical YouTube CSP page, so this is built from YouTube's documented serving domains: the player frame comes from www.youtube.com or www.youtube-nocookie.com, and thumbnails come from i.ytimg.com.

Content-Security-Policy:
    frame-src https://www.youtube-nocookie.com https://www.youtube.com;
    img-src 'self' https://i.ytimg.com

Allow both frame hosts. The youtube-nocookie.com privacy domain sets fewer tracking cookies and uses the same embed, but a player can still fall back to www.youtube.com for related-video links, so listing only the nocookie host breaks those.

Google Ads and Tag Manager

Ad and tag scripts are the broadest and the riskiest entries on this list, because Tag Manager exists specifically to inject other scripts, and an ad slot can load code you never reviewed. Allowlisting every host they might reach turns the policy into a sieve. This is exactly the case 'strict-dynamic' is built for: trust the container by nonce and let it vouch for what it loads, instead of maintaining an ever-growing host list. See strict-dynamic explained and the GA and Tag Manager guide. Advertising and conversion tags (Google Ads, DoubleClick, Floodlight) each reach their own hosts, and the set depends on which tags fire, so measure with Report-Only rather than allowlisting a static ad host list up front.

Find the hosts your site actually loads

The reliable way to build these lists is to stop guessing and measure. Scan a live page and let the violation reports tell you which hosts are loaded and which your policy would block, including the third parties your third parties pull in (the ones no cheat sheet can predict). The CSP scanner and CentralCSP's violation reporting turn a real page into an exact, current host list.

Next steps

Build the base policy: how to build a strong CSP.
Drop the allowlists later: strict-dynamic explained.
Verify the live header: security headers scanner.

Scan your site and see what your CSP blocks.