Skip to main content
Checks for Content-Security-Policy header
Rule IDsecurity/csp
CategorySecurity
ScopePer-page
Severityinfo
Weight4/10

​
Solution

CSP prevents XSS attacks by restricting which resources can load. Start with a report-only policy to identify issues. Key directives: default-src ‘self’, script-src (avoid ‘unsafe-inline’), img-src, style-src, frame-ancestors. Use nonces or hashes instead of ‘unsafe-inline’ for scripts. Test thoroughly as strict CSP can break functionality.

​
Enable / Disable

​
Disable this rule

squirrel.toml
[rules]
disable = ["security/csp"]

​
Disable all Security rules

squirrel.toml
[rules]
disable = ["security/*"]

​
Enable only this rule

squirrel.toml
[rules]
enable = ["security/csp"]
disable = ["*"]