How to fix missing content security policy on Shopify

Steps for Shopify

1. Shopify does not allow arbitrary HTTP response headers to be set from the admin UI for storefront pages.
2. Install a Shopify app such as 'EasyCSP' or 'CSP Manager' from the Shopify App Store, which injects the CSP header via a Shopify Proxy or middleware layer.
3. Alternatively, if you use Shopify with a custom Oxygen / Hydrogen (headless) front-end, set the CSP header inside your Remix/Next.js server response headers in the loader or server entry file.
4. For theme-level partial mitigation (not a true HTTP header), you can add a <meta http-equiv='Content-Security-Policy'> tag inside the <head> of your theme.liquid file (Online Store → Themes → Edit Code → layout/theme.liquid), but note that meta-tag CSPs do not cover all directives (e.g., frame-ancestors is ignored) and are weaker than HTTP headers.
5. The most robust Shopify approach is to route traffic through Cloudflare (free plan available) and set the CSP as a Cloudflare Transform Rule (see Cloudflare entry below).

What is missing content security policy?

A Content Security Policy (CSP) is an instruction you send to your visitors' web browsers, embedded in a special HTTP header, that tells the browser exactly which sources of scripts, images, styles, fonts, and other content it is allowed to load on your site. Think of it as a strict guest list at a nightclub door: anything not on the list gets turned away. Without a CSP header, the browser will happily load resources from anywhere — including malicious scripts injected by attackers. Your site currently sends no CSP header at all, which means that protection layer is completely absent.

Without a CSP, your store is significantly more vulnerable to Cross-Site Scripting (XSS) attacks — one of the most common ways attackers steal customer data, hijack sessions, or install payment-skimming code (like Magecart) directly in your shoppers' browsers. A successful XSS attack can expose customers' credit card numbers, passwords, and personal information, leading to chargebacks, fines under GDPR/CCPA, PCI-DSS violations, and severe reputational damage. Google also considers site security as a ranking signal, so a visibly compromised site can lose organic search rankings fast. Adding a CSP is recognized by OWASP as a critical defense-in-depth control against injection attacks (A03:2021).

See the complete Missing content security policy guide for every platform and the full background.