How to fix missing content security policy on Squarespace
Add a Content-Security-Policy (CSP) response header to every page so browsers block unauthorized scripts, styles, and resources from loading.
Steps for Squarespace
- Squarespace does not support custom HTTP response headers through its admin panel.
- Proxy your Squarespace site behind Cloudflare (change your domain's nameservers to Cloudflare), then set the CSP header via Cloudflare Dashboard → your domain → Rules → Transform Rules → Modify Response Headers → Add `Content-Security-Policy` header.
- Ensure your Cloudflare CSP policy includes Squarespace's own CDN domains (e.g., `static1.squarespace.com`, `use.typekit.net` if using custom fonts) to avoid breaking your site design.
- Test the live site with browser DevTools after deployment to confirm no critical resources are blocked.
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; object-src 'none'; frame-ancestors 'none'; base-uri 'self';What is missing content security policy?
A Content Security Policy (CSP) is an HTTP response header your web server sends to a visitor's browser. It acts like a whitelist, telling the browser exactly which domains and sources are allowed to load scripts, stylesheets, images, fonts, and other content on your site. If a piece of code tries to load from a source not on your list — for example, a malicious script injected by an attacker — the browser simply refuses to run it. Without a CSP header, the browser has no such instructions and will run whatever code it finds on the page.
Without a CSP, your store is significantly more vulnerable to Cross-Site Scripting (XSS) and data-injection attacks — the #3 risk in the OWASP Top Ten. Attackers who find even a small vulnerability in a plugin, theme, or third-party widget can inject malicious scripts that steal customer payment card details, session cookies, or personal data directly from the browser (a technique known as "formjacking" or "Magecart"). A successful attack can result in PCI-DSS compliance failures, card-brand fines, regulatory penalties under GDPR or CCPA, and severe damage to customer trust. Search engines also consider site security as a ranking signal, and a compromised site can be blocklisted by Google, wiping out organic traffic overnight.
See the complete Missing content security policy guide for every platform and the full background.
Not sure if your Squarespace store has this?
Run a free SEOLZ audit — we’ll find missing content security policy and every other issue across your whole site.
Scan my site free