How to Create a Content Security Policy Without Breaking Your Site

Inventory resources before writing directives

List scripts, styles, images, fonts, frames, connections, workers, and media loaded by each page type. Include first-party subdomains and required third parties. A guessed allowlist either breaks the site or becomes so broad that it offers little protection.

Start with a restrictive fallback

Use default-src as a baseline and add specific directives where behavior differs. Prefer exact origins and deliberate nonces or hashes for scripts over broad schemes, wildcards, unsafe-inline, or unsafe-eval.

Test in report-only mode

Send Content-Security-Policy-Report-Only first so violations can be observed without blocking resources. Exercise login, checkout, uploads, editors, error pages, and embedded content; a quiet homepage is not sufficient coverage.

Enforce one surface and keep rollback ready

Fix unexpected dependencies, remove unused sources, then enforce on a representative surface. Monitor errors and policy reports, document a rollback condition, and repeat until the enforced policy covers the site.

Core CSP directives