Serving ads on CSP-enabled sites
To serve ads on your site, place the ad unit code within the HTML of your site's pages. Sites that support Content Security Policy only execute this ad tag under special circumstances. Specifically, the browser must be granted permission via the HTTP header to process data, which includes permission to display ads, load images, and use styles.
Add the following code to the HTTP header:
Content-Security-Policy:
default-src 'none';
connect-src 'self' blob: yastatic.net *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com;
frame-src yandexadexchange.net *.yandexadexchange.net yastatic.net *.yandex.ru *.adfox.ru;
img-src 'self' *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com data:;
media-src yastatic.net *.yandex.net *.yandex.ru *.adfox.ru yandex.ru yandex.com blob: data:;
script-src 'unsafe-inline' 'unsafe-eval' yastatic.net *.yandex.ru *.adfox.ru yandex.ru yandex.com verify.yandex.ru;
style-src 'unsafe-inline' 'unsafe-eval' yastatic.net *.adfox.ru;
font-src 'self' yastatic.net data:;
For img-src, we recommend adding an array of *.yandex.ru subdomains. This way, you won't have to change your settings in the future.
-
The HTTP header directives script-src and style-src should receive the nonce attribute. This attribute must contain a string value composed of a random sequence of Latin characters and numbers. This value must be randomly generated on the server, independently for each request.
Content-Security-Policy: script-src 'nonce-<character sequence>'; style-src 'nonce-<character sequence>' -
Add the following code to the HTTP header:
Content-Security-Policy: default-src 'none'; connect-src 'self' blob: yastatic.net *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com; frame-src yandexadexchange.net *.yandexadexchange.net yastatic.net *.yandex.ru *.adfox.ru; img-src 'self' *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com data:; media-src yastatic.net *.yandex.net *.yandex.ru *.adfox.ru yandex.ru yandex.com blob: data:; script-src 'nonce-<character sequence>' 'unsafe-inline' 'unsafe-eval' yastatic.net *.yandex.ru *.adfox.ru yandex.ru yandex.com verify.yandex.ru; style-src 'nonce-<character sequence>' 'unsafe-inline' 'unsafe-eval' yastatic.net *.adfox.ru; font-src 'self' yastatic.net data:;For
img-src, we recommend adding an array of *.yandex.ru subdomains. This way, you won't have to change your settings in the future. -
Add the value of the nonce attribute applied in the first step into the code of each Yandex Advertising Network ad unit on your site's pages.
<div id="yandex_rtb_R-A-123456-1"></div> <script type="text/javascript" nonce="<character sequence>"> (function(w, d, n, s, t) { w[n] = w[n] || []; ...
Contact support
You can also go to
