Hotjar needs script-src and connect-src entries covering its script and data-collection domains (check Hotjar's own current documentation for exact hosts, since vendor domains can change), plus img-src, frame-src and style-src allowances if you use Hotjar's feedback widgets or surveys - a CSP that only whitelists the script domain but not the connect domain will let the snippet load while every actual recording or heatmap upload silently fails.
Why this happens
A strict CSP is enforced per directive, not as one blanket allow or deny for a vendor - script-src only governs whether the JavaScript file itself can load and execute, while the actual behavioral data (mouse movement, clicks, page structure for heatmaps) is sent afterward as separate network requests governed by connect-src, and sometimes img-src for pixel-style beacons.
It is entirely possible for Hotjar's script to visibly "work" - no console errors on load - while every subsequent data-upload request is silently blocked by a connect-src policy that only ever accounted for the script's own domain, which is why this failure mode is easy to miss without specifically checking the Network tab for blocked requests.
Fix it
- Add Hotjar's current script hosts to script-src - check Hotjar's own CSP documentation at implementation time, since exact subdomains are Hotjar's to change.
- Add Hotjar's data-collection hosts to connect-src separately - this is the directive most commonly missed, and the one that breaks recording upload even when the script itself loads fine.
- If using Hotjar Surveys or Feedback widgets, also confirm frame-src and style-src/font-src cover any additional assets those widgets load.
- Avoid relying on unsafe-inline as a blanket fix - Hotjar's snippet is designed to work with a properly scoped explicit host list, which is more secure and more precisely diagnosable.
- Test the full CSP change in report-only mode (Content-Security-Policy-Report-Only) first, so you can see exactly which directive would still block Hotjar before enforcing the policy in production.
How to verify it worked
With the updated CSP live, open DevTools' Network tab, reload the page, and confirm Hotjar's data-collection requests return successfully - no blocked:csp status - alongside the script load itself. Cross-check the console for any remaining CSP violation naming a Hotjar-related host.