1 files changed, 15 insertions, 0 deletions
diff --git a/spec/features/users/google_analytics_csp_spec.rb b/spec/features/users/google_analytics_csp_spec.rb
new file mode 100644
index 00000000000..46a9b3be22f
--- /dev/null
+++ b/spec/features/users/google_analytics_csp_spec.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Google Analytics 4 content security policy' do
+  it 'includes the GA4 content security policy headers' do
+    visit root_path
+
+    expect(response_headers['Content-Security-Policy']).to include(
+      '*.googletagmanager.com',
+      '*.google-analytics.com',
+      '*.analytics.google.com'
+    )
+  end
+end