Source CMS provides HTML Snippets to insert custom Hypertext Markup Language (HTML), JavaScript, and tracking code into site <head> and <body> sections without theme file modification or code deployment. Third-party integrations require script tags or meta tags on a site. The HTML Snippets configuration form provides a secure method to perform these additions in Content Security Policy (CSP) constraints.
Configuration Details
Path: /admin/config/search/html-snippets
Permission required: Administer HTML snippet
Security and script execution
Source CMS enforces a strict CSP to protect sites from Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) attacks. When you add <script> tags through HTML Snippets, the system assigns a cryptographic nonce to each script tag. This nonce enables script execution without a reduction in site security.
Scripts that inject dynamically at runtime such as those through Google Tag Manager (GTM) Custom HTML tag types do not receive a nonce. CSP blocks these scripts to maintain site security.
Adding tracking and integration scripts
Insert code for third-party tools, such as chat widgets, accessibility tools, or consent banners, directly through HTML Snippets. Do not use external tools, such as GTM to inject these scripts. Browser Content Security Policy, CSP, blocks script injection from external utilities to protect the site from Cross-Site Scripting, XSS, attacks. Use GTM for market analysis tags and standard analytics.
HTML Snippets
Source CMS provides HTML Snippets to insert custom Hypertext Markup Language (HTML), JavaScript, and tracking code into site <head> and <body> sections without theme file modification or code deployment. Third-party integrations require script tags or meta tags on a site. The HTML Snippets configuration form provides a secure method to perform these additions in Content Security Policy (CSP) constraints.
Configuration Details
Path: /admin/config/search/html-snippets
Permission required: Administer HTML snippet
Security and script execution
Source CMS enforces a strict CSP to protect sites from Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) attacks. When you add <script> tags through HTML Snippets, the system assigns a cryptographic nonce to each script tag. This nonce enables script execution without a reduction in site security.
Scripts that inject dynamically at runtime such as those through Google Tag Manager (GTM) Custom HTML tag types do not receive a nonce. CSP blocks these scripts to maintain site security.
Adding tracking and integration scripts
Insert code for third-party tools, such as chat widgets, accessibility tools, or consent banners, directly through HTML Snippets. Do not use external tools, such as GTM to inject these scripts. Browser Content Security Policy, CSP, blocks script injection from external utilities to protect the site from Cross-Site Scripting, XSS, attacks. Use GTM for market analysis tags and standard analytics.
Integration script locations
Script type determines the selection between GTM and HTML Snippets.
HTML Snippets: Use HTML Snippets for third-party tools, such as chat widgets, accessibility tools, or consent banners, to avoid CSP blocks.
Google Tag Manager: Use GTM exclusively for market analysis tags and standard analytics. Avoid the Custom HTML tag type in GTM to prevent browser CSP blocks and protect the site from XSS attacks.
On the Sites tab, locate the site to which you want to add a domain.
Click Edit Site.
On the left navigation menu, click Configuration.
The system displays the Configuration menu.
Click Search and metadata.
In the Drop-down menu, select HTML Snippet.
Paste the code into the designated field based on the script requirements:
Start of <head>: Use this field for scripts that must load early such as consent managers, Search Engine Optimization (SEO) verification tags, or analytics base scripts.
Allowed tags include script, style, meta, link, title, and noscript.
End of <body>: Use this field for scripts that render User Interface (UI) elements such as chat widgets, feedback tools, or accessibility overlays.
Allowed tags include script, div, span, noscript, iframe, and img.
Toggle Load HTML snippets in Drupal Canvas Preview if snippets must open during content edits in Drupal Canvas.
Note
HTML Snippets do not load in Drupal Canvas page builder preview by default. You must select the Load HTML snippets in Drupal Canvas Preview checkbox if a snippet is a requirement to edit content, such as a consent banner that affects layout.
Click Save configuration.
Note
Changes take effect immediately on the published site. Snippets do not load on the editorial domain by default.
Integration script locations
Script type determines the selection between GTM and HTML Snippets.
HTML Snippets: Use HTML Snippets for third-party tools, such as chat widgets, accessibility tools, or consent banners, to avoid CSP blocks.
Google Tag Manager: Use GTM exclusively for market analysis tags and standard analytics. Avoid the Custom HTML tag type in GTM to prevent browser CSP blocks and protect the site from XSS attacks.
On the Sites tab, locate the site to which you want to add a domain.
Click Edit Site.
On the left navigation menu, click Configuration.
The system displays the Configuration menu.
Click Search and metadata.
In the Drop-down menu, select HTML Snippet.
Paste the code into the designated field based on the script requirements:
Start of <head>: Use this field for scripts that must load early such as consent managers, Search Engine Optimization (SEO) verification tags, or analytics base scripts.
Allowed tags include script, style, meta, link, title, and noscript.
End of <body>: Use this field for scripts that render User Interface (UI) elements such as chat widgets, feedback tools, or accessibility overlays.
Allowed tags include script, div, span, noscript, iframe, and img.
Toggle Load HTML snippets in Drupal Canvas Preview if snippets must open during content edits in Drupal Canvas.
Note
HTML Snippets do not load in Drupal Canvas page builder preview by default. You must select the Load HTML snippets in Drupal Canvas Preview checkbox if a snippet is a requirement to edit content, such as a consent banner that affects layout.
Click Save configuration.
Note
Changes take effect immediately on the published site. Snippets do not load on the editorial domain by default.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Source CMS