KKorrali Web

Security headers › Content-Security-Policy

How to add the Content-Security-Policy header in Apache

CSP tells the browser which sources of scripts, styles, images and frames are allowed on your pages.

Apache configuration (.htaccess or virtual host)

<IfModule mod_headers.c>
  Header always set Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
</IfModule>

Requires mod_headers (a2enmod headers on Debian/Ubuntu). Reload Apache after editing the virtual host.

Before you deploy

A strict CSP can break analytics, fonts and inline scripts. Start with Content-Security-Policy-Report-Only, watch the reports, then enforce. The value here is a starting point you will need to extend.

Verify it works

curl -sI https://your-site.com | grep -i content-security-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Apache