When also using Cloudflare Pages or Workers
Plausible needs its origin in connect-src as well as script-src
Hard-won · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-15
Name https://plausible.io in both script-src and connect-src. Adding
only script-src is the trap: the tag loads, runs, raises nothing a visitor
would see, and every event POST is blocked.
A dashboard reading zero is indistinguishable from a site with no traffic, so the failure gets attributed to the audience rather than the header. Widen by naming the origin, never by relaxing a directive.
Check from outside after deploying, with a cache-buster — the edge served a stale copy for several minutes here, long enough to report a false negative.