Installing and tracking
Content Security Policy
Allow the PageDuel script and event connection under a strict CSP.
PageDuel's site installer can check common CSP problems. Your script-src must allow the PageDuel script host, and connect-src must allow the configured API host. If you use a nonce or 'strict-dynamic', ensure the PageDuel tag receives the correct nonce or is loaded by a trusted script.
Prefer a first-party installation when policy rules cannot allow an external host. After every CSP change, load the site with browser developer tools open and check both Console and Network for blocked script, config, heartbeat, or event requests.