How to add a Content-Security-Policy
A CSP limits which scripts and resources can load, reducing the damage from injected code.
Why it matters
If an attacker ever slips a script onto your page, through a vulnerable plugin or a compromised third party, a CSP stops the browser running it. It is the single strongest defence against cross-site scripting.
Steps
- Start in report-only mode so nothing breaks.
- List the domains your site genuinely loads scripts, styles, images and fonts from.
- Build a policy that allows only those, then watch the reports.
- Switch from report-only to enforcing once reports are quiet.
For your developer
Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data: https:
Check it worked
Browse your key pages with the browser console open. No "Refused to load" messages means the policy fits. Then confirm the content-security-policy header appears in the response.
Not sure if this affects your site?
Run a free scan to see exactly which of these your website needs.