Set object-src to 'none' on Shopify
Why it matters
Without a restrictive object-src, object and embed tags can load content from any source. Hardly any site still needs plugins, so blocking them is usually free.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Shopify's own header has no fetch directives, so this comes from a meta http-equiv Content-Security-Policy tag in your theme (layout/theme.liquid or a snippet it renders) or from an app. In Online Store, Themes, Edit code, search for Content-Security-Policy; if an app prints the tag, ask its developer.
- Check that no page uses object or embed tags (PDF viewers sometimes do), then add object-src 'none' to the tag's content value and save.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.