Skip to content
MDView as Markdown

Google AdSense

Google does not publish a domain allowlist for AdSense, and that is deliberate: the domains the ad code uses change over time, so any list you build will silently go stale and start blocking ads. Google supports a strict, nonce-based CSP instead.

CSP is not required to run AdSense, but if you have one, it has to follow Google's guidance or you risk disrupting ad serving.

What Google AdSense gives you

  • Support for a strict CSP built on nonces and 'strict-dynamic', rather than a list of domains to allow.

  • A documented policy that Google supports:

    object-src 'none'; script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:; base-uri 'none'; report-uri https://your-report-collector.example.com/

  • Nothing stops you being more restrictive, but Google warns that more restrictive policies may break without notice.

Sending reports to Report URI

Google's own recommended policy already ends in a report-uri directive - swap in the URL from your Setup page:

report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Google also recommends starting with Content-Security-Policy-Report-Only to find violations before you enforce, which is exactly what that endpoint is for.

Things to watch for

  • The nonce has to go on every script tag, including the AdSense code itself. A missing nonce on one tag is the usual cause of ads disappearing.
  • 'unsafe-inline' and 'unsafe-eval' in the supported policy look alarming. In a nonce-based policy, browsers that understand nonces ignore 'unsafe-inline', and it is there as a fallback for older browsers - but it does mean the policy is doing less for you than a nonce-only policy would.
  • Building your own AdSense domain allowlist is the one approach Google actively warns against. Resist the temptation, even when your reports make it look easy.

Official documentation

Google AdSense - Integrate the AdSense ad code with a Content Security Policy (CSP)

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page.

Start your free trial