Send the Content-Security-Policy as an HTTP header on Apache
Why it matters
A policy in a meta tag cannot use frame-ancestors, reporting or sandbox, and it only protects what comes after the tag in the page. The same policy sent as a response header covers the whole document.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: add the policy as a report-only header in the virtual host or .htaccess (mod_headers), optionally followed by ; frame-ancestors 'self', and reload.
- Stage 2: rename it to Content-Security-Policy and remove the meta tag.
apache
Header always set Content-Security-Policy-Report-Only "<content value of the meta tag>" Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.