Source: https://docs.amadalis.ai/privacy/head-and-csp/

# Head entries and Content Security Policy

Use **Privacy & Data** > **[Consent](https://docs.amadalis.ai/reference/glossary/#consent)** > **Head & CSP** in the site admin to review added page code and [Content Security Policy](https://docs.amadalis.ai/reference/glossary/#content-security-policy) (CSP), the rules that control which resources can load. In **Enforce** mode, CSP can stop third party scripts from loading unless the policy permits them. Ask a developer to review code and policy values with you.

Checked against the product’s code on 7 November 2026.

Open **Privacy & Data** > **Consent** > **Head & CSP**. Only an Admin can change head entries or the site’s policy. Other roles see the entries without their code. Its changes can affect every public page.

## Add or edit an entry

Code configured to run before consent can transmit data before a visitor makes a choice.

1.  Under **Head entries**, choose **Blank raw HTML** or **Tag manager template**, or open an existing entry.
2.  Review its content.
3.  Review the consent purpose it should wait for.

To edit a saved entry, select its row under **Head entries** to open its editor.

After opening a new or saved entry:

1.  Edit the intended content or setting.
2.  Choose **Review entry change**.
3.  Inspect the proposed change and its Content Security Policy permissions.
4.  Approve only the prepared change you intend.
5.  Read the receipt.

Editing one entry does not silently rewrite every other entry.

Praxis controls when its managed entry is released. It cannot verify what a remote vendor does after its code runs. Authored page JavaScript has its own behavior; configure it separately to honor the visitor’s choices.

## Review the site policy

**Rollout mode**, which controls whether the policy blocks resources, starts at **Report only**, which observes without blocking. **Enforce** blocks anything not permitted. Review the directives, which are rules for each kind of resource, and their permitted sources under **Site-wide CSP permissions**. An enforced policy can block a resource or submission that is not permitted.

An optional reporting address receives reports of resources that break the policy when the relevant browser and policy send them; configuring it is not proof reports arrived.

1.  Choose **Review site-wide CSP change**.
2.  Read its consequences.
3.  Apply only the intended plan.
4.  Read the result.

Read the receipt’s offered Undo and inspect the public result. Visitors see the change within the hour, usually much sooner. While the site’s server is down, visitors may see the previous version of a page for up to a day. Use [Privacy and consent](https://docs.amadalis.ai/trust/privacy-and-consent/) for the site’s consent rules, and [page scripts](https://docs.amadalis.ai/developers/page-scripts-and-events/) for JavaScript attached to one page.