Send the Content-Security-Policy as an HTTP header on Shopify
Why it matters
A policy in a meta tag cannot use frame-ancestors, reporting or sandbox, and it only protects what comes after the tag in the page. The same policy sent as a response header covers the whole document.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify does not let stores set response headers, so the meta tag in the theme is the only way to add a policy on Shopify. Keep it, and leave frame-ancestors out of it because browsers ignore that directive in a meta tag.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.