> ## Documentation Index
> Fetch the complete documentation index at: https://help.standards.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom Scripts

<Badge color="red" size="lg" shape="pill">Enterprise</Badge>

Standards supports custom scripts so you can add third-party tools like analytics platforms, chatbots, and tracking pixels to your published project.

***

## Adding scripts

<Frame>
  <img src="https://mintcdn.com/standards/szmBQpByAbnMye-H/images/custom-scripts-02.png?fit=max&auto=format&n=szmBQpByAbnMye-H&q=85&s=503cd325ce791fa3e9ee44298264fc89" alt="Dashboard with custom scripts window open showing empty fields" width="2400" height="1200" data-path="images/custom-scripts-02.png" />
</Frame>

<Steps>
  <Step title="Select project">
    From the dashboard, select a project.
  </Step>

  <Step title="Select Edit beside custom scripts setting">
    On the **Tracking** tab, select the `Edit` button on the right side of the custom scripts item.
  </Step>

  <Step title="Input scripts">
    Paste scripts into the fields in the custom scripts window. See below for more information.
  </Step>
</Steps>

### Header scripts

Scripts injected into the `<head>` of your published project. Use this for tools that need to load early, such as analytics snippets or tag managers. Must be one or more valid `<script></script>` blocks. For example:

```html theme={null}
<script src="https://example.com/analytics.js"></script>
<script>
    analytics.init("YOUR_KEY");
</script>
```

### Footer scripts

Scripts injected before the closing `</body>` tag. Use this for tools that don’t need to load until after the page content, such as chatbots or feedback widgets. Must be one or more valid `<script></script>` blocks.

### Allowed domains

If your scripts need to load resources or make network requests to external domains, add those domains here. This updates the project’s Content Security Policy (CSP) to allow connections to and scripts from those domains. Enter one domain per line. Supports wildcards for subdomains:

```text theme={null}
https://example.com
https://*.analytics-provider.com
```

### Include user identity

When enabled, the Standards Analytics API will include the visitor’s email, user ID, and IP address in event data. This only applies to projects that require login (SSO, invite-only, or domain-restricted access). See the Standards [Analytics API](/analytics-api) for more details.

***

## Security

* Only valid `<script>` blocks are accepted, arbitrary HTML is not allowed
* External domains must be explicitly allowed via the Allowed Domains field
* The Content Security Policy restricts where scripts can load from and what network requests they can make
* Admin-only access: only workspace admins can configure custom scripts

***

## Removing scripts

Select `Remove scripts` in the Custom Scripts window to clear all header scripts, footer scripts, and allowed domains at once.
