AI Cyber Shield

How to add a Content-Security-Policy (CSP)

CSP is the strongest defence against XSS: it sets where your site may load scripts, styles and images from, so even injected code does not run.

Important: the example's default-src 'self' blocks everything loaded from other sites — Google Analytics, fonts, chat, payments. Start with the Content-Security-Policy-Report-Only header and the same value, check the console for what is blocked, add the sources you need, and only then switch to the enforcing header.

How to fix it, by platform

WordPress

Where: your theme's functions.php (or a snippets plugin)

add_action('send_headers', function () {
  header("Content-Security-Policy: default-src 'self'");
});

WordPress sends the Content-Security-Policy header on every page load.

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

Cloudflare

Where: Cloudflare dashboard → Rules → Transform Rules → Modify Response Header → Add

Set static  —  Header name: Content-Security-Policy  —  Value: default-src 'self'

Cloudflare injects the Content-Security-Policy header at the edge, no server change needed.

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

Vercel / Next.js

Where: next.config.js → async headers()

module.exports = {
  async headers() {
    return [{ source: "/(.*)", headers: [
      { key: "Content-Security-Policy", value: "default-src 'self'" },
    ]}];
  },
};

Next.js sets the Content-Security-Policy header on every route.

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

Netlify

Where: a `_headers` file in your publish directory (or netlify.toml)

/*
  Content-Security-Policy: default-src 'self'

Netlify applies the Content-Security-Policy header to all paths (`/*`).

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

Nginx

Where: nginx.conf — inside your `server { }` block, then reload nginx

add_header Content-Security-Policy "default-src 'self'" always;

Adds the Content-Security-Policy header for every response.

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

Apache

Where: .htaccess (or the vhost config), then restart Apache

Header always set Content-Security-Policy "default-src 'self'"

Adds the Content-Security-Policy header via mod_headers.

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

IIS

Where: web.config — inside <system.webServer><httpProtocol><customHeaders>

<add name="Content-Security-Policy" value="default-src 'self'" />

Adds the Content-Security-Policy header in IIS.

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

Your web server

Where: your web server's response-header configuration

Content-Security-Policy: default-src 'self'

Configure your server/CDN to send this header on all responses.

How to confirm: Reload the site and check the response headers include `Content-Security-Policy`.

Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.

Scan your site free

Related guides