---
title: "HTML Snippets"
date: "2026-06-03T11:06:11+00:00"
summary: "Add custom HTML, JavaScript, and tracking scripts to your Drupal site securely with Acquia Source CMS HTML Snippets—no code deployment needed."
image:
type: "page"
url: "/acquia-source/html-snippets"
id: "62fe9de8-19c1-4370-8fad-c4791e7a2b89"
---

Acquia Source CMS provides HTML Snippets to insert custom Hypertext Markup Language (HTML), JavaScript, and tracking code into site `<head>` and `<body>` sections without theme file modification or code deployment. Third-party integrations require script tags or meta tags on a site. The HTML Snippets configuration form provides a secure method to perform these additions in Content Security Policy (CSP) constraints. 

### Configuration Details

*   **Path**: /admin/config/search/html-snippets
*   **Permission required**: Administer HTML snippet

Security and script execution
-----------------------------

Acquia Source CMS enforces a strict CSP to protect sites from Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) attacks. When you add `<script>` tags through HTML Snippets, the system assigns a cryptographic nonce to each script tag. This nonce enables script execution without a reduction in site security.

Scripts that inject dynamically at runtime such as those through Google Tag Manager (GTM) **Custom HTML** tag types do not receive a nonce. CSP blocks these scripts to maintain site security.

Adding tracking and integration scripts
---------------------------------------

Insert code for third-party tools, such as chat widgets, accessibility tools, or consent banners, directly through HTML Snippets. Do not use external tools, such as GTM to inject these scripts. Browser Content Security Policy, CSP, blocks script injection from external utilities to protect the site from Cross-Site Scripting, XSS, attacks. Use GTM for market analysis tags and standard analytics.

### Integration script locations

Script type determines the selection between GTM and HTML Snippets.

*   **HTML Snippets**: Use HTML Snippets for third-party tools, such as chat widgets, accessibility tools, or consent banners, to avoid CSP blocks.
*   **Google Tag Manager**: Use GTM exclusively for market analysis tags and standard analytics. Avoid the Custom HTML tag type in GTM to prevent browser CSP blocks and protect the site from XSS attacks.

Adding HTML Snippets
--------------------

To add HTML Snippets:

1.  Log in to [Acquia Source](https://source.acquia.com/) to open the Sites Dashboard.
2.  On the **Sites** tab, locate the site to which you want to add a domain.
3.  Click **Edit Site**.
4.  On the left navigation menu, click **Configuration**.

The system displays the Configuration menu.

5.  Click **Search and metadata**.
6.  In the Drop-down menu, select **HTML Snippet**. 
7.  Paste the code into the designated field based on the script requirements:
    *   **Start of <head>**: Use this field for scripts that must load early such as consent managers, Search Engine Optimization (SEO) verification tags, or analytics base scripts. 
        
        Allowed tags include `script`, `style`, `meta`, `link`, `title`, and `noscript`.
        
    *   **End of <body>**: Use this field for scripts that render User Interface (UI) elements such as chat widgets, feedback tools, or accessibility overlays. 
        
        Allowed tags include `script`, `div`, `span`, `noscript`, `iframe`, and `img`.
        
8.  Toggle **Load HTML snippets in Drupal Canvas Preview** if snippets must open during content edits in Drupal Canvas.

Note

HTML Snippets do not load in Drupal Canvas page builder preview by default. You must select the **Load HTML snippets in Drupal Canvas Preview** checkbox if a snippet is a requirement to edit content, such as a consent banner that affects layout.

9.  Click Save configuration.

Note

Changes take effect immediately on the published site. Snippets do not load on the editorial domain by default.