---
metadata:
  - name: generator
    content: Diplodoc Platform v5.52.0
alternate:
  - https://www.yandex.com/support/partner/en/web/adplatform/csp-configuration.md
  - https://www.yandex.com/support/partner/ru/web/adplatform/csp-configuration.md
  - href: en/web/adplatform/csp-configuration.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
---
> **Documentation Index:** Fetch the complete configuration index at https://www.yandex.com/support/partner/en/llms.txt

# Serving ads on CSP-enabled sites

To serve ads on your site, place the ad unit code within the HTML of your site's pages. Sites that support [Content Security Policy](https://www.w3.org/TR/CSP/) only execute this ad tag under special circumstances. Specifically, the browser must be granted permission via the HTTP header to process data, which includes permission to display ads, load images, and use styles.


{% list tabs %}

- Without the nonce attribute


  Add the following code to the HTTP header:

  ```javascript
   Content-Security-Policy:
    default-src 'none';
    connect-src 'self' blob: yastatic.net *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com;
    frame-src yandexadexchange.net *.yandexadexchange.net yastatic.net *.yandex.ru *.adfox.ru;
    img-src 'self' *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com data:;
    media-src yastatic.net *.yandex.net *.yandex.ru *.adfox.ru yandex.ru yandex.com blob: data:;
    script-src 'unsafe-inline' 'unsafe-eval' yastatic.net *.yandex.ru *.adfox.ru yandex.ru yandex.com verify.yandex.ru;
    style-src 'unsafe-inline' 'unsafe-eval' yastatic.net *.adfox.ru;
    font-src 'self' yastatic.net data:;
  ```

  For `img-src`, we recommend adding an array of _*.yandex.ru_ subdomains. This way, you won't have to change your settings in the future.


- Using the nonce attribute


  1. The HTTP header directives [script-src](https://www.w3.org/TR/CSP/#script_src) and [style-src](https://www.w3.org/TR/CSP/#directive-style-src) should receive the [nonce](https://www.w3.org/TR/CSP/#source-list-valid-nonces) attribute. This attribute must contain a string value composed of a random sequence of Latin characters and numbers. This value must be randomly generated on the server, independently for each request.

      ```no-highlight
      Content-Security-Policy:
      script-src 'nonce-<character sequence>';
      style-src 'nonce-<character sequence>'
      ```

  1. Add the following code to the HTTP header:

      ```javascript
      Content-Security-Policy:
        default-src 'none';
        connect-src 'self' blob: yastatic.net *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com;
        frame-src yandexadexchange.net *.yandexadexchange.net yastatic.net *.yandex.ru *.adfox.ru;
        img-src 'self' *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com data:;
        media-src yastatic.net *.yandex.net *.yandex.ru *.adfox.ru yandex.ru yandex.com blob: data:;
        script-src 'nonce-<character sequence>' 'unsafe-inline' 'unsafe-eval' yastatic.net *.yandex.ru *.adfox.ru yandex.ru yandex.com verify.yandex.ru;
        style-src 'nonce-<character sequence>' 'unsafe-inline' 'unsafe-eval' yastatic.net *.adfox.ru;
        font-src 'self' yastatic.net data:;
      ```

      For `img-src`, we recommend adding an array of _*.yandex.ru_ subdomains. This way, you won't have to change your settings in the future.

  1. Add the value of the [nonce](https://www.w3.org/TR/CSP/#source-list-valid-nonces) attribute applied in the first step into the code of each Yandex Advertising Network ad unit on your site's pages.
      ```javascript
      <div id="yandex_rtb_R-A-123456-1"></div>
      <script type="text/javascript" nonce="<character sequence>">
        (function(w, d, n, s, t) {
        w[n] = w[n] || [];
        ...
      ```

{% endlist %}



<!-- source: en/_includes/feedback-forms/common-buttons.md -->
## Contact support




<details>
    <summary class="button">Write to WhatsApp</summary>
    <img src="https://yastatic.net/s3/doc-binary/src/support/partner/qr-codes/gr-code-en-new.svg" style="width: 100%; display: block;"/>
    <a href="https://wa.me/74952583554?utm_source=yan&utm_medium=help&utm_campaign=en" style="display: block; text-align: left; margin-left: 18px; color: #5889FF;">Go to WhatsApp</a>
</details>

 <details>
    <summary class="button">Write to Telegram</summary>
    <img src="https://yastatic.net/s3/doc-binary/src/support/partner/en/qr-codes/qr-code-en-telegram.svg" style="width: 100%; position: relative; left: -18px; display: block;"/>
    <a href="http://t.me/YanSupport_Bot" style="display: block; text-align: left; margin-left: 18px; color: #5889FF;">Go to Telegram</a>
</details> 

<a href="https://yandex.ru/chat?context=%7B%22entrypoint%22%3A%22%7B%5C%22entrypoint%5C%22%3A%5C%22help%5C%22%2C%5C%22a_pagename%5C%22%3A%5C%22partner-en%5C%22%7D%22%7D#/user/00155607-f40f-9af8-7910-84a29fd95914"> <!--ссылка, куда ведет кнопка. Если внутренняя ссылка, пишем без .md и .html --> 
  <span class="button">Write to chat</span> <!--текст на кнопке--> 
</a>


<a href="https://forms.yandex.com/surveys/10014803/?lang=en"> <!--ссылка, куда ведет кнопка. Если внутренняя ссылка, пишем без .md и .html --> 
  <span class="button">Send an email</span> <!--текст на кнопке--> 
</a>



<!-- source: en/_includes/feedback-forms/button-style.md -->

<!-- endsource: en/_includes/feedback-forms/button-style.md -->

<div width="100%" align="center"> 
<br><br>
You can also go to
<br><br>

[![](https://yastatic.net/s3/doc-binary/src/support/mobile-ads/en/logo/rsya.svg)](https://partner.yandex.com)

</div>

<div><br><br></div>
<div class="container" style="padding: 0;">
  <div class="column">
      <p style="font-size: large;">Useful links</p>
      <ul>
         <li><a href="https://yandex.ru/legal/partner/" target="_blank">Rules of participation</a></li>
         <li><a href="https://yandex.ru/legal/yan_service_offer/?lang=en" target="_blank">Yandex Advertising Network Terms of Offer</a></li>
      </ul>
  </div>   
</div>
<div><br><br></div>


<!-- endsource: en/_includes/feedback-forms/common-buttons.md -->