---
description: How to run Google AdSense under a strict Content Security Policy with nonces, and how to send CSP violation reports to Report URI.
---

# Google AdSense

Google does not publish a domain allowlist for AdSense, and that is deliberate: the domains the ad code uses change over time, so any list you build will silently go stale and start blocking ads. Google supports a strict, nonce-based CSP instead.

CSP is not required to run AdSense, but if you have one, it has to follow Google's guidance or you risk disrupting ad serving.

## What Google AdSense gives you

- Support for a strict CSP built on nonces and `'strict-dynamic'`, rather than a list of domains to allow.
- A documented policy that Google supports:

        object-src 'none'; script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:; base-uri 'none'; report-uri https://your-report-collector.example.com/

- Nothing stops you being more restrictive, but Google warns that more restrictive policies may break without notice.

## Sending reports to Report URI

Google's own recommended policy already ends in a `report-uri` directive - swap in the URL from your [Setup](https://report-uri.com/account/setup/) page:

    report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Google also recommends starting with `Content-Security-Policy-Report-Only` to find violations before you enforce, which is exactly what that endpoint is for.

## Things to watch for

- The nonce has to go on **every** script tag, including the AdSense code itself. A missing nonce on one tag is the usual cause of ads disappearing.
- `'unsafe-inline'` and `'unsafe-eval'` in the supported policy look alarming. In a nonce-based policy, browsers that understand nonces ignore `'unsafe-inline'`, and it is there as a fallback for older browsers - but it does mean the policy is doing less for you than a nonce-only policy would.
- Building your own AdSense domain allowlist is the one approach Google actively warns against. Resist the temptation, even when your reports make it look easy.

## Official documentation

[Google AdSense - Integrate the AdSense ad code with a Content Security Policy (CSP)](https://support.google.com/adsense/answer/16283098?hl=en)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)