Fix the Content-Security-Policy syntax

Why it matters

Browsers skip directives they do not know and read unquoted keywords as host names, so parts of the policy silently do nothing. The finding's details list what was ignored.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Quote the keywords: 'self', 'none', 'unsafe-inline', 'unsafe-eval', 'strict-dynamic', 'report-sample', nonces and hashes all need single quotes. Separate directives with semicolons.
2. Fix misspelled directive names and remove obsolete ones such as block-all-mixed-content, plugin-types, referrer and reflected-xss. In a meta tag, leave out frame-ancestors, report-uri and sandbox, which only work in the header.
3. Stage 1: fixed directives start to take effect, so send the corrected policy as Content-Security-Policy-Report-Only first. Stage 2: enforce it once the reports are clean.

# ignored: bare keywords are read as host names
Content-Security-Policy: default-src self; script-src self https://scripts.vendor.example
# works
Content-Security-Policy: default-src 'self'; script-src 'self' https://scripts.vendor.example

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles