# How to add a Content-Security-Policy

> A CSP tells browsers which scripts, styles and frames may load, and blocks most cross-site scripting even when a plugin has a hole.

Security · HTML version: https://getreport.app/learn/content-security-policy

## Content-Security-Policy header

Passing looks like: Content-Security-Policy header is set.

**Why it matters.** A CSP blocks most cross-site scripting attacks by listing where scripts may load from. Without one, a single injected script can steal sessions or card data.

**How to fix it.**

1. Start in report-only mode with Content-Security-Policy-Report-Only to see what would break.
2. Move to an enforcing policy once the report is quiet; keep "unsafe-inline" out of script-src.

## Inline and wildcard scripts in CSP

Passing looks like: Content-Security-Policy blocks inline and wildcard scripts.

**Why it matters.** A script-src with 'unsafe-inline', 'unsafe-eval' or a * source still lets an injected script run, so the policy gives little of the protection you set it up for.

**How to fix it.**

1. Move inline scripts into files and allow them by nonce or hash instead of 'unsafe-inline'.
2. Replace * with the exact origins your scripts load from; drop 'unsafe-eval' once no library needs it.

Check your own page: https://getreport.app/