Presets

The presets are the classes of the plugin, in PieceOfCake2\SecurityHeaders\ContentSecurityPolicy, with the sources that a service needs in the Content Security Policy. List those that your pages use in contentSecurityPolicyAllow (see Allowing Other Sites):

php

use PieceOfCake2\SecurityHeaders\ContentSecurityPolicy\GoogleTagManager;
use PieceOfCake2\SecurityHeaders\ContentSecurityPolicy\YouTube;

Configure::write('SecurityHeaders', [
    'contentSecurityPolicyAllow' => [GoogleTagManager::class, YouTube::class],
]);

The sources come from the guides of the services when they publish one, and otherwise from their embed codes and base codes, opened with the enforced policy in Chrome.
Checked every week: the presets marked so are opened in Chrome with their policy, against the services, every week and at each release; the check fails when the browser reports a violation. The others need an account of the service to run.
The embed and the conversion tag of a service are separate presets, e.g. Facebook for the Page plugin and MetaPixel for the conversions of the ads: list only those that your pages use.
The scripts are in script-src instead of script-src-elem of the guides of Google, so that the browsers without script-src-elem, such as Safari before 15.4, allow them too.
The services change their hosts from time to time. If the console of the browser reports a host that a preset does not have, add it to contentSecurityPolicyAllow with a name, and tell us in an issue.
Tag Managers and Analytics: GoogleTagManager, GoogleTagManagerPreview, GoogleAnalytics, GoogleAnalyticsWithAds, AdobeTags, AdobeAnalytics, AdobeWebSdk
Conversion Tags (CV) of the Ads: GoogleAds, Floodlight, MerchantCenter, MetaPixel, TikTokPixel, XPixel, LineTag, YahooJapanAds, MicrosoftAds
Embedded Contents: GoogleMaps, GoogleMapsEmbed, YouTube, Facebook, Instagram, X, TikTok, Line

Tag Managers and Analytics

`GoogleTagManager`

The container of Google Tag Manager. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From Google's guide. Checked every week.

Directive	Sources
`script-src`	`https://www.googletagmanager.com`
`img-src`	`https://www.googletagmanager.com`
`connect-src`	`https://www.googletagmanager.com` `https://www.google.com`

Its snippet, with the nonce, which it also passes to the script that it loads, as in Google's guide:

php

<!-- In <head> of the layout -->
<script nonce="<?= h($this->SecurityHeaders->nonce()) ?>">(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;var n=d.querySelector('[nonce]');
n&&j.setAttribute('nonce',n.nonce||n.getAttribute('nonce'));f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-XXXXXXX');</script>

The custom JavaScript variables need 'unsafe-eval' in script-src: use custom templates instead if you can. Tag Assistant lists the resources that the policy blocks, in Page issues.

`GoogleTagManagerPreview`

The preview mode of Google Tag Manager.

From Google's guide.

Directive	Sources
`script-src`	`https://www.googletagmanager.com` `https://tagmanager.google.com`
`style-src`	`https://www.googletagmanager.com` `https://tagmanager.google.com` `https://fonts.googleapis.com`
`img-src`	`https://www.googletagmanager.com` `https://ssl.gstatic.com` `https://www.gstatic.com`
`font-src`	`https://fonts.gstatic.com` `data:`

`GoogleAnalytics`

Google Analytics, without the features of Google Ads. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From Google's guide. Checked every week.

Directive	Sources
`script-src`	`https://www.googletagmanager.com`
`img-src`	`https://www.googletagmanager.com` `https://*.google-analytics.com`
`connect-src`	`https://www.googletagmanager.com` `https://.google-analytics.com` `https://.google.com`

Without Tag Manager, its gtag.js snippet has an inline script: <script nonce="<?= h($this->SecurityHeaders->nonce()) ?>">.

`GoogleAnalyticsWithAds`

Google Analytics, with the features of Google Ads (Google Signals, remarketing). Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From Google's guide.

Directive	Sources
`script-src`	`https://www.googletagmanager.com`
`img-src`	`https://www.googletagmanager.com` `https://.google-analytics.com` `https://.google.com` `https://*.g.doubleclick.net`
`connect-src`	`https://www.googletagmanager.com` `https://.google-analytics.com` `https://.google.com` `https://*.g.doubleclick.net` `https://pagead2.googlesyndication.com`
`frame-src`	`https://www.googletagmanager.com`

Add the domain of the country of your users, e.g. https://*.google.co.jp to img-src and connect-src: a policy cannot have a wildcard at the end of a host.

`AdobeTags`

The library of Adobe Experience Platform Tags (formerly Adobe Launch) on the host of Adobe.

From Adobe's guide.

Directive	Sources
`script-src`	`https://assets.adobedtm.com`

Load the library asynchronously. Add the classes of its extensions, e.g. AdobeAnalytics, and the nonce for its custom code: set a data element of the nonce in the Core extension.

`AdobeAnalytics`

Adobe Analytics (AppMeasurement) with the Experience Cloud Identity Service.

From Adobe's guide.

Directive	Sources
`script-src`	`https://*.demdex.net` `https://cm.everesttech.net` `https://assets.adobedtm.com`
`img-src`	`https://.omtrdc.net` `https://.2o7.net` `https://*.demdex.net` `https://cm.everesttech.net` `https://assets.adobedtm.com`
`connect-src`	`https://.omtrdc.net` `https://.2o7.net` `https://*.demdex.net` `https://cm.everesttech.net` `https://assets.adobedtm.com`
`frame-src`	`https://*.demdex.net`

Add your tracking server if it is on a domain of yours (a CNAME).

`AdobeWebSdk`

The Web SDK of Adobe Experience Platform; *.demdex.net is for the migration of the visitors (idMigrationEnabled).

From Adobe's guide.

Directive	Sources
`connect-src`	`https://.adobedc.net` `https://.demdex.net`

Add your edge domain if edgeDomain is a domain of yours (a CNAME).

Conversion Tags (CV) of the Ads

`GoogleAds`

Google Ads: the conversions, the remarketing, the conversion linker and the user data. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From Google's guide.

Directive	Sources
`script-src`	`https://www.googletagmanager.com` `https://www.googleadservices.com` `https://www.google.com`
`img-src`	`https://www.googletagmanager.com` `https://www.googleadservices.com` `https://googleads.g.doubleclick.net` `https://pagead2.googlesyndication.com` `https://www.google.com`
`connect-src`	`https://www.googletagmanager.com` `https://www.googleadservices.com` `https://googleads.g.doubleclick.net` `https://pagead2.googlesyndication.com` `https://www.google.com` `https://ad.doubleclick.net`
`frame-src`	`https://www.googletagmanager.com`

Add the domain of the country of your users, e.g. https://www.google.co.jp to img-src and connect-src.

`Floodlight`

Floodlight, with its custom scripts. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From Google's guide.

Directive	Sources
`img-src`	`https://www.googletagmanager.com` `https://ad.doubleclick.net` `https://ade.googlesyndication.com` `https://adservice.google.com`
`connect-src`	`https://pagead2.googlesyndication.com` `https://www.google.com` `https://www.googleadservices.com` `https://ad.doubleclick.net`
`frame-src`	`https://www.googletagmanager.com` `https://*.fls.doubleclick.net`

`MerchantCenter`

Google Merchant Center. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From Google's guide.

Directive	Sources
`script-src`	`https://www.googletagmanager.com`
`img-src`	`https://*.merchant-center-analytics.goog`
`connect-src`	`https://*.merchant-center-analytics.goog`

`MetaPixel`

The Meta Pixel (Facebook Pixel), for the ads of Facebook and Instagram. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From the base code of Meta. Checked every week.

Directive	Sources
`script-src`	`https://connect.facebook.net`
`img-src`	`https://www.facebook.com`
`connect-src`	`https://www.facebook.com`
`frame-src`	`https://www.facebook.com`
`form-action`	`https://www.facebook.com`

Large events are posted with a form in a hidden frame to https://www.facebook.com/tr/, hence frame-src and form-action.

`TikTokPixel`

The TikTok Pixel. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From the base code of TikTok. Checked every week.

Directive	Sources
`script-src`	`https://analytics.tiktok.com`
`img-src`	`https://analytics.tiktok.com`
`connect-src`	`https://analytics.tiktok.com` `https://analytics-ipv6.tiktokw.us`

`XPixel`

The X Pixel (formerly Twitter Pixel) of X Ads. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From the base code of X. Checked every week.

Directive	Sources
`script-src`	`https://static.ads-twitter.com`
`img-src`	`https://analytics.twitter.com` `https://t.co`
`connect-src`	`https://analytics.twitter.com` `https://t.co`

`LineTag`

The LINE Tag of LINE Ads. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From the base code of LINE. Checked every week.

Directive	Sources
`script-src`	`https://d.line-scdn.net` `https://tag.flvcdn.net`
`img-src`	`https://tr.line.me`
`connect-src`	`https://tr.line.me`

`YahooJapanAds`

The conversion tags and the site retargeting tags of Yahoo! JAPAN Ads, of the search ads and the display ads, with the site general tag (ytag.js). Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From the announcement of Yahoo! JAPAN Ads and the tags. Checked every week.

Directive	Sources
`script-src`	`https://s.yimg.jp` `https://b91.yahoo.co.jp` `https://b97.yahoo.co.jp` `https://b98.yahoo.co.jp` `https://b99.yahoo.co.jp`
`img-src`	`https://b91.yahoo.co.jp` `https://b97.yahoo.co.jp` `https://b98.yahoo.co.jp` `https://b99.yahoo.co.jp` `https://apm.yahoo.co.jp`
`connect-src`	`https://b91.yahoo.co.jp` `https://b97.yahoo.co.jp` `https://b98.yahoo.co.jp` `https://b99.yahoo.co.jp` `https://apm.yahoo.co.jp` `https://dm.slim02.jp`

The tags of the search ads load their scripts from and send their events to b9x.yahoo.co.jp; those of the display ads send theirs to apm.yahoo.co.jp, and the site general tag some to dm.slim02.jp.

`MicrosoftAds`

The UET tag of Microsoft Advertising. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From the base code of Microsoft. Checked every week.

Directive	Sources
`script-src`	`https://bat.bing.com`
`img-src`	`https://bat.bing.com` `https://bat.bing.net`
`connect-src`	`https://bat.bing.com` `https://bat.bing.net`

Embedded Contents

`GoogleMaps`

The Maps JavaScript API of Google Maps. Turns on the nonce: its code has an inline script, see Inline Scripts and the Nonce.

From the guide of the Maps JavaScript API (the allowlist policy). Checked every week.

Directive	Sources
`script-src`	`'unsafe-eval'` `https://.googleapis.com` `https://.gstatic.com` `https://.google.com` `https://.ggpht.com` `https://*.googleusercontent.com` `blob:`
`img-src`	`https://.googleapis.com` `https://.gstatic.com` `https://.google.com` `https://.googleusercontent.com` `data:`
`frame-src`	`https://*.google.com`
`connect-src`	`https://.googleapis.com` `https://.google.com` `https://*.gstatic.com` `data:` `blob:`
`font-src`	`https://fonts.gstatic.com`
`style-src`	`'unsafe-inline'` `https://fonts.googleapis.com`
`worker-src`	`blob:`

It adds 'unsafe-eval' to script-src and 'unsafe-inline' to style-src, as the guide. The 'unsafe-inline' of script-src of the guide is left out: the inline script, e.g. the callback, needs the nonce. If you load the API from the domain of a country, e.g. maps.google.fr, add it.