Fix guide · Web application · low

Content-Security-Policy missing

A Content-Security-Policy tells the browser which sources your pages may load scripts, styles and frames from. Without one, a single injected script (from a vulnerable plugin, a compromised ad or a comment field) runs with full access to the page and your visitors' sessions.

Time to fix

30 minutes to a few hours

Risk if ignored

Injected scripts run unrestricted

Breaks anything?

It can, so start in report-only mode

How to fix it

Start in report-only mode, in the server block:

add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'self'" always;

Watch the browser console for a few days, add the sources you actually use, then rename the header to Content-Security-Policy.

In the VirtualHost or .htaccess (needs mod_headers):

Header always set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'self'"

When nothing legitimate is reported, change it to Content-Security-Policy.

Rules → Transform Rules → Modify Response Header → Set static:

Header name: Content-Security-Policy-Report-Only
Value: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'self'

Switch the name to Content-Security-Policy once the reports are clean.

Plugins usually need extra sources. A common starting point:

default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; frame-ancestors 'self'

Set it with a headers plugin or in your server config, report-only first.

Even a loose policy with frame-ancestors 'self' is a real improvement. Tighten it over time.

Check your fix

Common mistakes

Enforcing a strict policy on day one and breaking analytics, fonts or embeds.
Adding 'unsafe-eval' "just to make it work". It removes most of the protection.
Setting it in a <meta> tag only. frame-ancestors is ignored there.