Content Security Policy is blocking the script

A CSP block always announces itself in the browser console, naming the directive. That message tells you exactly which of the two problems you have.

Which one you have

The script never loaded:

Refused to load the script 'https://truestat.io/js/t.js' because it violates
the following Content Security Policy directive: "script-src 'self'".

The script loaded and cannot send:

Refused to connect to 'https://truestat.io/api/events' because it violates
the following Content Security Policy directive: "connect-src 'self'".

The second is far more common, because people add script-src and stop. The script loads, no script error appears, and every event is blocked silently.

The fix

Both directives:

Content-Security-Policy: script-src 'self' https://truestat.io; connect-src 'self' https://truestat.io;

If you already have a longer policy, add https://truestat.io to both existing directives rather than replacing anything.

Where to put it, per platform, is in Content Security Policy.

If you add it and nothing changes

Two traps, and between them they cover almost every "I added it and it still does not work".

A server header is overriding your meta tag

Server headers win over <meta http-equiv>. If your host sets a CSP header and you add a meta tag, the meta tag is ignored entirely.

Check from a terminal:

curl -sI https://example.com | grep -i content-security-policy

If that prints anything, you have to edit that header — the meta tag route is not available to you.

There are two policies and they intersect

Browsers apply the most restrictive combination of every policy present. Adding a second, looser header does not loosen the first.

Look for a CSP set in more than one place: your framework config, your host's settings, a security plugin, a CDN's header rules. Find the restrictive one and edit that.

The Network tab shows every response header on the document request, which is the fastest way to spot two.

The shorter fix

If editing headers is awkward — a managed host, someone else's security plugin, a policy you do not own — serve the script from your own domain.

Once both t.js and /api/events are same-origin, 'self' covers them and your CSP needs no TrueStat entry at all. That is often less work than getting a header changed, and it also gets you past ad blockers.

If you proxy through a separate subdomain, 'self' does not cover it — both directives must name it:

script-src 'self' https://a.example.com; connect-src 'self' https://a.example.com;

What TrueStat does not need

No unsafe-inline, no unsafe-eval, no img-src, no style-src, no frame-src, no frame-ancestors change.

If a guide tells you to add any of those for analytics, it is not describing this script — and none of them is a good thing to add.

Verify

After changing the policy:

1. Hard-reload the page — CSP headers cache.

2. Console: no CSP messages naming TrueStat.

3. Network: t.js is 200 and POST /api/events is 202.

4. The install page in the app flips to Connected.

If the console is clean and the POST still does not happen, it is not the CSP — go back to No events are showing up.