How to fix missing content security policy on Wix

Steps for Wix

1. Wix does not currently allow custom HTTP response headers on standard Wix sites.
2. For Wix Studio / custom domains using a reverse proxy or Cloudflare, add the CSP header at the proxy/CDN layer (see Cloudflare approach).
3. As a partial measure, Wix Velo (developer mode) lets you inject a <meta http-equiv='Content-Security-Policy'> tag into the page <head> via the 'Custom Code' feature: go to Settings → Custom Code → Add Code to Head, and paste the meta tag. Note this is weaker than an HTTP header.
4. Raise this requirement with Wix Support or vote on Wix Feature Requests, as custom HTTP header support is a frequently requested feature.

What is missing content security policy?

A Content Security Policy (CSP) is an instruction you send to your visitors' web browsers, embedded in a special HTTP header, that tells the browser exactly which sources of scripts, images, styles, fonts, and other content it is allowed to load on your site. Think of it as a strict guest list at a nightclub door: anything not on the list gets turned away. Without a CSP header, the browser will happily load resources from anywhere — including malicious scripts injected by attackers. Your site currently sends no CSP header at all, which means that protection layer is completely absent.

Without a CSP, your store is significantly more vulnerable to Cross-Site Scripting (XSS) attacks — one of the most common ways attackers steal customer data, hijack sessions, or install payment-skimming code (like Magecart) directly in your shoppers' browsers. A successful XSS attack can expose customers' credit card numbers, passwords, and personal information, leading to chargebacks, fines under GDPR/CCPA, PCI-DSS violations, and severe reputational damage. Google also considers site security as a ranking signal, so a visibly compromised site can lose organic search rankings fast. Adding a CSP is recognized by OWASP as a critical defense-in-depth control against injection attacks (A03:2021).

See the complete Missing content security policy guide for every platform and the full background.