Fix the Content-Security-Policy syntax on Shopify
Why it matters
Browsers skip directives they do not know and read unquoted keywords as host names, so parts of the policy silently do nothing. The finding's details list what was ignored.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sets the storefront's response headers. If the ignored directives come from a meta tag in your theme, fix them in layout/theme.liquid; otherwise the store cannot change them.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
Scan your domain to see whether this applies to you.