From 0a708af9bcbf31db548ea273cd16c1db17addb38 Mon Sep 17 00:00:00 2001
From: Vincent Boutour <bob@vibioh.fr>
Date: Sun, 26 Aug 2018 18:43:03 +0200
Subject: [PATCH] Adding CSP directives in README

---
 README.md | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 547d140..e8993fe 100644
--- a/README.md
+++ b/README.md
@@ -31,16 +31,18 @@ For getting a development version of Fathom up & running, go through the followi
 
 To install and run Fathom in production, [have a look at the installation instructions](https://github.com/usefathom/fathom/wiki/Installing-&-running-Fathom).
 
-## Building with Docker
+## Docker
+
+### Building
 
 Ensure you have Docker installed and run `docker build -t fathom .`.
 Run the container with `docker run -d -p 8080:8080 fathom`.
 
-## Running with Docker
+### Running
 
 To run [our pre-built Docker image](https://hub.docker.com/r/usefathom/fathom/), run `docker run -d -p 8080:8080 usefathom/fathom:latest`
 
-#### Tracking snippet 
+## Tracking snippet
 
 To start tracking, include the following JavaScript on your site and replace `yourfathom.com` with the URL to your Fathom instance.
 
@@ -61,6 +63,15 @@ fathom('trackPageview');
 <!-- / Fathom -->
 ```
 
+### Content Security Policy
+
+If you use a [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) to specify security policies for your website, Fathom requires the following CSP directives (replace `yourfathom.com` with the URL to your Fathom instance):
+
+```
+script-src: yourfathom.com;
+img-src: yourfathom.com;
+```
+
 ## Copyright and license
 
 MIT licensed. Fathom and Fathom logo are trademarks of Fathom Analytics.