Content Security Policy: a first policy, tried out in report-only mode

The short answer: Content Security Policy (CSP) is a header that tells the browser where the site may load scripts, styles and images from. If someone injects an outside script, the browser refuses it. It is strong, but it is also easy to break a site with it; so you start in report-only mode, which only warns and blocks nothing.

What the site needs

What What to do
What it controls Allowed origins for the site’s scripts, styles, images, fonts, videos and connections.
Report-only mode The Content-Security-Policy-Report-Only header records what it would block, without blocking. It is the mode for rehearsing.
What usually breaks Scripts and styles written inside the page itself, Google Analytics and Tag Manager, outside fonts, embedded videos: Tag Manager.
A first policy Accept everything only from the site itself, then add the outside origins the site really uses.
When to start blocking When the log has been clean for a few days, on all the important pages.

Getting started

1 Take a copy of .htaccess.
2 Put the policy in report-only mode with a simple line (add the outside origins afterwards): Header set Content-Security-Policy-Report-Only "default-src 'self'"
3 Browse the site with the browser console open (F12, Console tab): each thing that would be blocked shows as a warning.
4 Add the outside origins the site uses on purpose (analytics, fonts, video), one at a time.
5 When the warnings stop, switch to the header that blocks (Content-Security-Policy) and test again: Security headers.
A policy that is too tight breaks the site. If you go straight to the blocking mode you may lose the menu, the form or the checkout without warning. Always test in report-only mode, and in another browser. If something breaks, go back to the copy of .htaccess.
If your site mixes http and https content, fix that first: Mixed content. Another header to turn on with care: HSTS.

Want help rehearsing a policy for your site? Open a ticket with the address.

Open a support ticket

SEE ALSO

Security headers explained: what they do and how to add them in .htaccess

HSTS explained: forcing https for good, and the trap of switching it on too early

Mixed content after moving to HTTPS: the padlock that will not turn on

Google Tag Manager and tracking pixels: adding them without slowing your site

ModSecurity and web application firewalls: what they do, and what to do when one blocks you

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from KSh858.00/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Forgotten subdomains and DNS records that point nowhere: how they get hijacked The short answer: when you stop using a service but forget the DNS record that pointed to it (a CNAME to a shop, a blog...