How do I setup the correct security using CSP?

Working with GTM, whether or not in combination with GA, requires communication with other parties. This is done via specific URLs.
This communication is blocked by default by what we call Content Security Policy.

We need to first add the URLs to the allowed list of URLs.

To do this, go to Configuration > System > Security Settings.

Under the heading "Content Security Policy (CSP) - Allowed domains" it is possible to add domains.
Some examples

• For GTM : "*.googletagmanager.com"
• For GA: "*.google-analytics.com" and "*.analytics.google.com"

If this step is skipped or not performed correctly, an error message will appear in the network tab of the browser: blocked by CSP.