Content-Security-Policy header

Recommended value

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

What it protects against

Cross-site scripting (XSS) and data injection, by blocking scripts from sources you did not approve. frame-ancestors also prevents clickjacking.

Before you turn it on

A strict CSP can break analytics, fonts and inline scripts. Start with Content-Security-Policy-Report-Only, watch the reports, then enforce. The value here is a starting point you will need to extend.

How to add Content-Security-Policy

• Content-Security-Policy in Nginx
• Content-Security-Policy in Apache
• Content-Security-Policy in Cloudflare
• Content-Security-Policy in Vercel
• Content-Security-Policy in Netlify
• Content-Security-Policy in Next.js