KKorrali Web

Security headers › Content-Security-Policy

How to add the Content-Security-Policy header in Netlify

CSP tells the browser which sources of scripts, styles, images and frames are allowed on your pages.

Netlify configuration (_headers file)

/*
  Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

Put the _headers file in your publish directory, or use a [[headers]] block in netlify.toml, then redeploy.

Before you deploy

A strict CSP can break analytics, fonts and inline scripts. Start with Content-Security-Policy-Report-Only, watch the reports, then enforce. The value here is a starting point you will need to extend.

Verify it works

curl -sI https://your-site.com | grep -i content-security-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Netlify