Skip to content
FixSecurityHeadersScan a site

How to add Content-Security-Policy on Nginx

Last updated · Reviewed by a CISSP-certified security practitioner

To add Content-Security-Policy on Nginx, set the header in nginx.conf (server block) with the value default-src 'self'; script-src 'self'; style-src 'self'; …. Controls which scripts, styles and frames a page may load. Run nginx -t, then systemctl reload nginx. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Content-Security-Policy do?

CSP is an allow-list for where your page may load scripts, styles, images, frames and connections from. It is the strongest defence against cross-site scripting.

Risk if missing: Without a CSP, any injected script (XSS, a compromised third‑party tag, a Magecart skimmer) runs with full access to your users' sessions and payment forms.

What is the Nginx configuration?

Add this to nginx.conf (server block):

nginx.conf (server block)
# Inside your server { } block
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests" always;

How do I add it step by step?

  1. Open nginx.conf (server block).
  2. Paste the Content-Security-Policy configuration shown below.
  3. Run nginx -t, then systemctl reload nginx.
  4. Run curl -I https://yourdomain.com and look for the content-security-policy line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "content-security-policy"
# expected:
# content-security-policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Deploy as Content-Security-Policy-Report-Only first and watch reports before enforcing.
  • 'unsafe-inline' and 'unsafe-eval' in script-src remove most of the XSS protection. Use nonces or hashes.
  • Analytics, chat widgets and payment iframes need their hosts added explicitly.
  • Only one CSP header should be sent; multiple policies are intersected, which often blocks more than expected.
  • Always add the always flag so headers are sent on error responses too.
  • add_header in a location block replaces all add_header directives inherited from server — repeat them or use an include file.

Quick reference

HeaderContent-Security-Policy
Recommended valuedefault-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
StackNginx
Wherenginx.conf (server block)
CompliancePCI DSS 4.0 6.4.3, PCI DSS 4.0 11.6.1, OWASP ASVS V14.4.3, SOC 2 CC6.8, NIST 800-171 3.13.1

FAQ

What value should I use for Content-Security-Policy?

A safe default is default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests. Deploy as Content-Security-Policy-Report-Only first and watch reports before enforcing.

Why isn't Content-Security-Policy showing up on Nginx?

Always add the always flag so headers are sent on error responses too. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Content-Security-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Content-Security-Policy?

PCI DSS 4.0 6.4.3, PCI DSS 4.0 11.6.1, OWASP ASVS V14.4.3, SOC 2 CC6.8, NIST 800-171 3.13.1.

Related guides