What is happening
A Content-Security-Policy (CSP) is a header or meta tag that lists the addresses a page may load scripts from (script-src) and send data to (connect-src, img-src). When a tracking tag sends to an address the policy does not list, the browser blocks the request before it leaves.
The tag looks installed and running. Only the request fails, so nothing reaches Meta, Google, TikTok or whichever platform it is.
Why it starts suddenly
This commonly happens when a platform starts routing some visitors to a second domain that the policy was never updated for. It can affect only some regions, so it is easy to miss when you test from elsewhere. A security hardening of the site that tightened the policy is the other usual trigger.
How to spot it
Open the browser console. A CSP block shows as a message like “Refused to connect to … because it violates the following Content Security Policy directive”, naming the blocked address. In the Network panel the request is marked blocked, often (blocked:csp).
The scan reads the browser's own error for every failed request, so it can tell a CSP block from a connection that simply failed. They are different faults with different fixes.
How to fix it
Add the blocked host to the policy: connect-src and img-src for the data requests, and script-src if the loader itself is refused. Then re-scan and confirm the requests complete.
What the report says
This is the finding TagZ writes when it sees this fault, word for word.
Meta Pixel is blocked by this site’s own security policy
The tag runs and tries to send, and the browser refuses because the site’s Content-Security-Policy does not allow the address it is sending to. Nothing reaches Meta Pixel for visitors routed to that address — which can be only some regions, so it is easy to miss when testing from elsewhere.
Suggested fix
The page's own security policy is blocking the request: the browser refused to send it. Add the endpoint's host shown above to the Content-Security-Policy (connect-src and img-src). This commonly happens when a platform starts routing some visitors to a second domain that the policy was never updated for.
A scan is one look. Tags break later.
A theme update, a plugin, a new cookie banner, someone tidying up an old account: tracking rarely breaks loudly. TagZ monitoring runs this same check every six hours in a real browser and emails you when a tag that was working stops sending, after a second scan has confirmed it.
$7.99 a month for one website, billed yearly ($95.88 a year), or $2.63 a site per month on the Agency plan for 25 sites, billed yearly. See all plans.