KKorrali Web

Security headers › Content-Security-Policy

How to add the Content-Security-Policy header in Vercel

CSP tells the browser which sources of scripts, styles, images and frames are allowed on your pages.

Vercel configuration (vercel.json)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
        }
      ]
    }
  ]
}

Add to vercel.json at the project root and redeploy. Next.js projects on Vercel can set headers in next.config instead.

Before you deploy

A strict CSP can break analytics, fonts and inline scripts. Start with Content-Security-Policy-Report-Only, watch the reports, then enforce. The value here is a starting point you will need to extend.

Verify it works

curl -sI https://your-site.com | grep -i content-security-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Vercel