How to fix missing content security policy on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. Adobe Commerce (and Magento Open Source) has built-in CSP support since version 2.3.5. Go to Admin Panel → Stores → Configuration → Security → Content Security Policy.
2. Set 'Enable CSP in Report Only Mode' to 'Yes' first to collect violations without breaking the site, then configure your policy directives in the same panel.
3. Alternatively, edit your theme's `csp_whitelist.xml` file (located at `app/design/frontend/[Vendor]/[Theme]/etc/csp_whitelist.xml`) to whitelist specific external domains per directive.
4. For server-level enforcement (recommended in addition to application-level), add `Header always set Content-Security-Policy "..."` to your Apache `.htaccess` or virtual host config, or `add_header Content-Security-Policy "..."` to your Nginx `server {}` block.
5. Run `bin/magento cache:flush` after any configuration changes, then verify with browser DevTools → Network → document response headers.

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; object-src 'none'; frame-ancestors 'none'; base-uri 'self';

What is missing content security policy?

A Content Security Policy (CSP) is an HTTP response header your web server sends to a visitor's browser. It acts like a whitelist, telling the browser exactly which domains and sources are allowed to load scripts, stylesheets, images, fonts, and other content on your site. If a piece of code tries to load from a source not on your list — for example, a malicious script injected by an attacker — the browser simply refuses to run it. Without a CSP header, the browser has no such instructions and will run whatever code it finds on the page.

Without a CSP, your store is significantly more vulnerable to Cross-Site Scripting (XSS) and data-injection attacks — the #3 risk in the OWASP Top Ten. Attackers who find even a small vulnerability in a plugin, theme, or third-party widget can inject malicious scripts that steal customer payment card details, session cookies, or personal data directly from the browser (a technique known as "formjacking" or "Magecart"). A successful attack can result in PCI-DSS compliance failures, card-brand fines, regulatory penalties under GDPR or CCPA, and severe damage to customer trust. Search engines also consider site security as a ranking signal, and a compromised site can be blocklisted by Google, wiping out organic traffic overnight.

See the complete Missing content security policy guide for every platform and the full background.