Content-Security-Policy settings for Google Maps
A tightened CSP header stops the loader before it ever reaches Google, so you get a CSP violation rather than a Maps error.
How to tell this is your problem
- Console shows CSP violations for maps.googleapis.com or maps.gstatic.com.
- The map broke after a security review.
- Tiles are missing while controls render.
Why it happens
Maps needs script, image, style, font and connect permissions across several Google hosts. Missing any one leaves a partly-rendered map.
The fix, step by step
- 01Allow maps.googleapis.com in script-src and connect-src.
- 02Allow maps.gstatic.com and *.googleapis.com in img-src, plus data: for inline markers.
- 03Allow fonts.googleapis.com in style-src and fonts.gstatic.com in font-src if you use Google fonts in info windows.
- 04Test in report-only mode first, then enforce.
Confirm it is fixed
With the console open there should be no CSP violations and every tile request should return 200.
Check whether this is your error
A scan tells you in about twelve seconds, from a clean session.