Why Pasted Custom Code Snippets Do Not Run On Your Pages?
Questions:
- Why is my custom code snippet not working on my page?
- Why does TYRIOS block raw analytics or marketing code?
- How do I fix a custom code snippet that will not run?
Description:
What you notice: you pasted a small piece of custom code directly into a page or template (often a snippet a marketing or analytics provider gave you) and it doesn't do anything.
Wny this happens: To block hackers, your shop refuses to run loose code that's pasted straight into a page — because that's exactly how attackers try to sneak in harmful code. This protection can't tell your pasted snippet apart from a malicious one, so it blocks both. This is one of the most important parts of the whole security feature.
The good news: there are safe ways to make your genuine snippet run.
Solution:
Most marketing and analytics snippets can be added the proper way instead of pasting raw code:
-
Many providers offer a small file to link to (rather than a block of code).
Linking to a file from a trusted company is allowed — just add that company to the trusted list, exactly like in How to Allow External Widgets and Scripts in Your Website
-
Navigate to the Dedicated Integration Module
For tracking and tag tools, use the dedicated integration in TYRIOS (for example a Tag Manager module) rather than pasting code into a page.
-
If the code really must be pasted in
Some snippets do need to live directly in a page. In that case the snippet needs a small "approval stamp" added to it so your shop recognises it as trusted. This is a quick change, but it has to be done by someone who can edit the page's template — your web agency or our support.
Tips and Tricks:
Pro-Tips:
-
Utilizing dedicated tracking modules is cleaner, safer, and usually exactly what the service provider recommends.
-
Keep a central log of all external tool providers you add to your trusted list for easy security audits.
-
Always test your tracking tools using provider-specific debuggers after completing the safe integration setup.
Warnings:
-
Don't ask anyone to "allow all inline code" to make the snippet work. That switch removes the single most important protection in your shop and would drop your security grade. The safe options above keep your protection intact.
Note for your agency: inline <script> is blocked because the policy is script-src 'self' 'nonce-…'. Either externalise the snippet (and whitelist its origin), or attach the per-request nonce: SecurityHeaderUtil::getNonce() → add as nonce="…" on the tag. Do not enable 'unsafe-inline'/'unsafe-eval' (enableUnsafeScript()) as a workaround. Inline styles are allowed by default, so only inline scripts need the nonce.