Step 1 — Pre-flight Check
Before you touch any code, confirm three things: your customer ID, your consent setup, and whether your site uses a Content Security Policy.
1.1 Your fraud0 customer ID (cid)
Section titled “1.1 Your fraud0 customer ID (cid)”Log in to your fraud0 Dashboard and copy the cid shown in the Implementation tab. Every code snippet in this guide uses this value wherever you see {{fraud0 cid}}.
1.2 The most important rule
Section titled “1.2 The most important rule”1.3 How is your site set up today?
Section titled “1.3 How is your site set up today?”Answer these four questions — they determine which embed path is right for you in the next step.
| Question | Notes | |
|---|---|---|
| Q1 | Is there a Consent Management Platform (CMP) on the site? | If no CMP, any embed path works. If yes, continue. |
| Q2 | Does the GTM container load before the CMP banner is interacted with? | ”Before” = the <script> for googletagmanager.com is in the <head> and runs unconditionally. |
| Q3 | Do you operate a Server-Side GTM (SGTM) endpoint on your own domain? | ”Yes” = GTM library is loaded from tagmanager.yourdomain.com or similar, not directly from googletagmanager.com. |
| Q4 | Does your website enforce a Content Security Policy script-src directive? | If yes, you will need to allow-list the fraud0 host (see 1.4 below). |
Your answers determine which option to choose in Steps 2–3.
1.4 Content Security Policy — extend it if you have one
Section titled “1.4 Content Security Policy — extend it if you have one”If your site sends a Content-Security-Policy header (or <meta http-equiv="Content-Security-Policy">) with a script-src directive, the fraud0 script will be blocked unless the host is allow-listed.
How to check: Open browser DevTools → Network tab → reload the page → inspect the document response headers. If you see a Content-Security-Policy header with a script-src directive that is not * or unsafe-inline-everything, you have one.
Add https://api.fraud0.com to your script-src:
script-src ... https://api.fraud0.com;If you also have connect-src or img-src directives, allow the same host there:
connect-src ... https://api.fraud0.com;img-src ... https://api.fraud0.com;For more detail on CSP errors, see the FAQ article on Network Status “blocked: CSP”.
Once you have your cid and know your setup, continue to the next step.