Andrew Welch

Perhaps if [`headlessMode`](https://craftcms.com/docs/3.x/config/config-settings.html#headlessmode) is enabled, we can use the CP URL?

What would the use-case be here? It should always be at: `/sitemap.xml` the standard location

You should be able to do this by doing something like (untested): ```twig {% do seomatic.script.get("googleTagManager").nonce("myNonce") %} ``` ...and the rest should just work from there. As for your third...

@roelvanhintum can you clarify what you mean? What exactly is being cached?

@roelvanhintum has this been sorted?

@roelvanhintum so I can think of ways around this, but I'm starting to believe that instead of a nonce, I think I should be using a hash: https://content-security-policy.com/hash/

I think it might be mis-typed, and should indeed be a string. Are you having an issue related to it?

Thanks, will have a look

Yeah that's the resolved image, it should be a string. Addressed in: https://github.com/nystudio107/craft-seomatic/commit/c1fe6e55f75a57339d8eedaab2f83ea44ae6a63e & https://github.com/nystudio107/craft-seomatic/commit/566aa6709d889ba3ec6e97270dc4acd9cc03ef77 Craft CMS 3: You can try it now by setting your semver in your `composer.json`...

The endpoint is off by default, for this reason: we wanted people to have to specifically enable it, understanding the implications. I will look into the method of protecting the...