Clarity tracking disabled: domain not authorized and cross-origin iframe data collection

1. Distinguishing the console message from a 404 script load

When the Clarity loader runs it first checks whether the current page’s domain is listed in the project’s domain whitelist. If it is not, the loader writes a console message similar to:

Clarity: Domain not authorized for this project.

This message appears in the browser console regardless of whether the script file can be fetched. A 404, on the other hand, is a network error that shows up in the Network tab as a failed request to the CDN URL (e.g. https://az416426.vo.msecnd.net/clarity/clarity.js). A 404 can be caused by an incorrect script URL, a blocked CDN, or a CSP that prevents the request.

To determine which case you’re seeing:

• Open the console – if you see the domain‑not‑authorized message, the domain is missing from the project list.
• Open the Network tab – if the request to the Clarity script URL returns 404 or is missing entirely, the script failed to load.
• Check for CSP violations in the console – a script-src violation can also appear as a 404‑like failure.

2. Interaction data from a page inside a cross‑origin iframe

Clarity instrumentation runs only in the same‑origin context that loads the script. If a page is embedded in a cross‑origin iframe, the script in the parent frame cannot access the iframe’s DOM, and vice‑versa. Consequently, events that occur inside a cross‑origin iframe are not captured by Clarity. Only first‑party events in the frame that loads the Clarity script are sent to the backend.

Verification steps:

1. Confirm the iframe’s src attribute uses a different origin than the parent.
2. Ensure the Clarity script is included in the iframe’s own HTML, not only in the parent.
3. Filter network traffic by frame URL; no XHR requests to https://az416426.vo.msecnd.net/clarity/ should originate from the child frame.

3. Do‑Not‑Track header handling

Clarity ignores the Do‑Not‑Track (DNT) header in both the standard script tag and the async loader integration. The script is fetched and executed regardless of the DNT setting, and the data it collects is sent to the backend. This behavior is documented as intentional; the SDK does not respect DNT.

Practical check:

• Open the page with a browser that supports DNT and enable the DNT flag.
• Verify that the Clarity script still appears in the Network tab and that XHR requests to the Clarity endpoint are present.

Quick diagnostics checklist

Script loadCSP violationCross‑origin iframeDNT handling

Check	What to look for
Domain whitelist	Console message: "Domain not authorized"
Network: 404 or missing script request
Console: "Refused to load the script because it violates the following Content Security Policy directive"
No Clarity XHR from child frame
Script loads even when DNT is enabled

If you observe a CSP violation that blocks the script, you may need to adjust your CSP script-src directive to include the Clarity CDN. If the domain is not authorized, add it to the project’s domain list in the Clarity portal.

Missing diagnostic detail

To refine the recommendation, could you confirm whether the page is rendered inside an iframe and whether that iframe is cross‑origin? This will determine if you need to add the Clarity script to the iframe itself.