Try or ByeTry or Bye

Hotjar Content Security Policy (CSP) Errors

Workaround available Web Updated October 21, 2026

Quick answer

A Content Security Policy that does not list Hotjar's domains blocks its script or connections, so nothing is collected. Add *.hotjar.com and *.hotjar.io (including wss://*.hotjar.com) to the right CSP directives.

Most likely fix: Read the exact directive in the console.

Symptoms

The browser console shows 'Refused to load the script' or 'Refused to connect' errors mentioning hotjar.com, and no data arrives.

Why it happens

  • CSP script-src does not allow Hotjar's domains
  • connect-src blocks Hotjar's API or websocket (wss://)
  • img-src or font-src blocks Hotjar resources
  • Platform or security plugin injects its own strict CSP

How to fix it

Try these in order — the most common fix is first.

  1. 1. Read the exact directive in the console

    1. Open developer tools > Console
    2. Note which directive is named (usually script-src or connect-src)

  2. 2. Add Hotjar's domains

    1. Add https://*.hotjar.com and https://*.hotjar.io to script-src, img-src and connect-src
    2. Add wss://*.hotjar.com to connect-src
    3. Prefer a nonce or hash over 'unsafe-inline' for the inline snippet

  3. 3. Check plugins and platform settings

    1. Security plugins or no-code platforms may hold their own allowed web request targets; add Hotjar there for each environment

This guide also covers

  • hotjar csp error
  • hotjar content security policy
  • hotjar refused to connect
  • hotjar script blocked

Still not working?

If Hotjar keeps failing, you're not alone. See every Hotjar problem users report or the alternatives people switch to.

Other Hotjar errors