Content-Security-Policy
- What it does
- CSP is an allow-list for where your page may load scripts, styles, images, frames and connections from. It is the strongest defence against cross-site scripting.
- Risk if missing
- Without a CSP, any injected script (XSS, a compromised third‑party tag, a Magecart skimmer) runs with full access to your users' sessions and payment forms.
Recommended value: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
Content-Security-Policy · Nginx
# Inside your server { } block
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests" always;Gotchas
- Deploy as Content-Security-Policy-Report-Only first and watch reports before enforcing.
- 'unsafe-inline' and 'unsafe-eval' in script-src remove most of the XSS protection. Use nonces or hashes.
- Analytics, chat widgets and payment iframes need their hosts added explicitly.
- Only one CSP header should be sent; multiple policies are intersected, which often blocks more than expected.