Send the Content-Security-Policy as an HTTP header

Why it matters

A policy in a meta tag cannot use frame-ancestors, reporting or sandbox, and it only protects what comes after the tag in the page. The same policy sent as a response header covers the whole document.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: copy the content value of the meta tag into a Content-Security-Policy-Report-Only response header, and optionally append ; frame-ancestors 'self' for framing protection. Check the developer console on every page type.
2. Stage 2: send it as Content-Security-Policy, then remove the meta tag from the template so there is one place to maintain it.

# Stage 1 (optionally append ; frame-ancestors 'self' to the value)
Content-Security-Policy-Report-Only: <content value of the meta tag>
# Stage 2, once nothing legitimate is reported: the same value, enforced
Content-Security-Policy: <content value of the meta tag>

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax