Enforce the report-only Content-Security-Policy on Shopify
Why it matters
A report-only policy reports violations but blocks nothing, so it gives no protection yet. Once its reports are clean, send the same policy as Content-Security-Policy.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify controls the storefront's response headers, so a report-only policy sent by the platform cannot be switched to enforcing from the store.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.