# CSP for Google services, the host cheat sheet (/en/blog/csp-for-google-services) Google services are some of the most common things a Content Security Policy (CSP) breaks, because each one loads from its own set of hosts and trips a different directive. The temptation is to widen the whole policy until the breakage stops, which quietly undoes the protection. This is a per-service cheat sheet instead: the specific directives each service needs, so you add exactly what is required and nothing more. Add these in [Report-Only](/en/blog/csp-enforce-vs-report-only) first, confirm nothing else breaks, then enforce. For Analytics and Tag Manager specifically, see the dedicated [CSP for Google Analytics and Tag Manager](/en/blog/csp-google-analytics-tag-manager) post, which covers the nonce details those need. The host lists below are a starting point, not gospel. Google changes hosts over time, and your exact set depends on which features you enable. Confirm the real hosts for your own site with a scan rather than copying a static list blind. ## Google Fonts [#google-fonts] [Google Fonts](https://developers.google.com/fonts/docs/getting_started) loads in two stages: a stylesheet from one host, then the font files it references from another. You need both directives or the text falls back to a system font. ```http Content-Security-Policy: style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com ``` ## Google Maps [#google-maps] The [Google Maps JavaScript API](https://developers.google.com/maps/documentation/javascript) is heavier: it loads its JavaScript, fetches map tiles as images, and makes API calls for geocoding and directions. That touches three directives. ```http Content-Security-Policy: script-src 'self' https://maps.googleapis.com; img-src 'self' https://maps.gstatic.com https://*.googleapis.com https://*.ggpht.com data:; connect-src 'self' https://maps.googleapis.com ``` The wildcards on `img-src` cover the tile hosts that plain `maps.gstatic.com` misses: Street View tiles come from `geo*.ggpht.com` and satellite tiles from `khms*.googleapis.com`, which `*.ggpht.com` and `*.googleapis.com` allow. Google's [Maps JavaScript API CSP guide](https://developers.google.com/maps/documentation/javascript/content-security-policy) lists this exact set. ## reCAPTCHA [#recaptcha] [reCAPTCHA](https://developers.google.com/recaptcha) loads a script from Google and renders its challenge inside a frame, so it needs both `script-src` and `frame-src`. The [reCAPTCHA CSP guidance](https://developers.google.com/recaptcha/docs/faq) scopes these to the `/recaptcha/` path rather than the whole host: ```http Content-Security-Policy: script-src 'self' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; frame-src https://www.google.com/recaptcha/ ``` If a network or region blocks `www.google.com`, Google documents `www.recaptcha.net` as the alternate host. Load the reCAPTCHA library from `www.recaptcha.net` and swap every `www.google.com/recaptcha/` reference to `www.recaptcha.net/recaptcha/` at the same time, in both `script-src` and `frame-src`, so the script origin and the frame origin stay in sync. ## YouTube embeds [#youtube-embeds] An embedded [YouTube](https://developers.google.com/youtube/player_parameters) player runs in an iframe, and the poster thumbnails load as images, so you need `frame-src` for the player and `img-src` for the thumbnails. Google does not publish a single canonical YouTube CSP page, so this is built from YouTube's documented serving domains: the player frame comes from `www.youtube.com` or `www.youtube-nocookie.com`, and thumbnails come from `i.ytimg.com`. ```http Content-Security-Policy: frame-src https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' https://i.ytimg.com ``` Allow both frame hosts. The `youtube-nocookie.com` privacy domain sets fewer tracking cookies and uses the same embed, but a player can still fall back to `www.youtube.com` for related-video links, so listing only the nocookie host breaks those. ## Google Ads and Tag Manager [#google-ads-and-tag-manager] Ad and tag scripts are the broadest and the riskiest entries on this list, because [Tag Manager](https://developers.google.com/tag-platform/tag-manager) exists specifically to inject other scripts, and an ad slot can load code you never reviewed. Allowlisting every host they might reach turns the policy into a sieve. This is exactly the case `'strict-dynamic'` is built for: trust the container by nonce and let it vouch for what it loads, instead of maintaining an ever-growing host list. See [strict-dynamic explained](/en/blog/strict-dynamic-csp) and the [GA and Tag Manager guide](/en/blog/csp-google-analytics-tag-manager). Advertising and conversion tags (Google Ads, DoubleClick, Floodlight) each reach their own hosts, and the set depends on which tags fire, so measure with Report-Only rather than allowlisting a static ad host list up front. ## Find the hosts your site actually loads [#find-the-hosts-your-site-actually-loads] The reliable way to build these lists is to stop guessing and measure. Scan a live page and let the violation reports tell you which hosts are loaded and which your policy would block, including the third parties your third parties pull in (the ones no cheat sheet can predict). The [CSP scanner](/tools/csp-scanner) and CentralCSP's [violation reporting](/en/docs/platform/monitoring/csp) turn a real page into an exact, current host list. ## Next steps [#next-steps] * Build the base policy: [how to build a strong CSP](/en/blog/how-to-build-a-strong-csp). * Drop the allowlists later: [strict-dynamic explained](/en/blog/strict-dynamic-csp). * Verify the live header: [security headers scanner](/tools/security-headers). [Scan your site and see what your CSP blocks](/register). ## Sources [#sources] * [Google, Maps JavaScript API and Content Security Policy](https://developers.google.com/maps/documentation/javascript/content-security-policy) * [Google, reCAPTCHA FAQ (CSP guidance and the recaptcha.net alternate host)](https://developers.google.com/recaptcha/docs/faq) * [Google, use Tag Manager with a Content Security Policy](https://developers.google.com/tag-platform/security/guides/csp) * [Google Fonts, getting started](https://developers.google.com/fonts/docs/getting_started)