Add a Content-Security-Policy on Cloudflare

Why it matters

Without a CSP the browser runs any script that ends up in your pages, so a single injection bug gives an attacker control of what visitors see and do. A policy limits where scripts, frames and plugins may load from.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: open Rules, Overview, choose Create rule, Response Header Transform Rule, and set the report-only header as below for this host. The DNS record must be Proxied.
2. Browse every page type with the developer console open and add the sources it reports to the policy (edit the rule's value).
3. Stage 2: when nothing legitimate is reported, change the header name in the rule to Content-Security-Policy. Note that Set static replaces any CSP your origin sends, and a transform rule cannot create per-response nonces; for nonces, generate the policy at the origin.

Rule type:     Response Header Transform Rule
If:            Hostname equals example.com
Operation:     Set static
Header name:   Content-Security-Policy-Report-Only
Value:         default-src 'self'; script-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax