How to add the Content-Security-Policy header in Nginx

Nginx configuration (nginx server block)

add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;

Place it in the server or location block, then run nginx -t and reload. add_header in a location block replaces headers set at server level, so repeat them where needed. The always flag sends the header on error responses too.

Before you deploy

A strict CSP can break analytics, fonts and inline scripts. Start with Content-Security-Policy-Report-Only, watch the reports, then enforce. The value here is a starting point you will need to extend.

Verify it works

curl -sI https://your-site.com | grep -i content-security-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Other headers in Nginx

• Strict-Transport-Security in Nginx
• X-Frame-Options in Nginx
• X-Content-Type-Options in Nginx
• Referrer-Policy in Nginx
• Permissions-Policy in Nginx
• Cross-Origin-Opener-Policy in Nginx
• Cross-Origin-Resource-Policy in Nginx