---
description: How to add a Content Security Policy header in Nginx with add_header, including the inheritance rule that silently drops your policy.
---

# Nginx

Adding a CSP header in Nginx is one line. Keeping it on every response is the part that catches people out, because `add_header` has an inheritance rule that quietly discards inherited headers - and it fails silently, so the first sign of trouble is usually a policy that is missing on exactly the pages you cared about.

## What Nginx gives you

- `add_header name value [always];` in `http`, `server`, `location` and `if in location` contexts.
- Values that can contain variables, so a policy can vary by request.
- `add_header_inherit` (Nginx 1.29.3 and later) with `on`, `off` and `merge`, to control the inheritance behaviour explicitly.

## Setting the header

Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

```nginx
add_header Content-Security-Policy-Report-Only "default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly" always;
```

That is the same starting policy we recommend for the [CSP Wizard](/setup/wizard/), and report-only blocks nothing.

## Things to watch for

- **The inheritance rule is the big one.** A child block inherits `add_header` directives from its parent *only if the child defines none of its own*. Add a single unrelated `add_header` inside a `location` and every header inherited from the `server` or `http` block - including your CSP - disappears from responses for that location. On 1.29.3 and later, `add_header_inherit merge;` fixes it. Before that, you have to repeat the directives in every block that defines any.
- Without `always`, the header is only added to a specific set of status codes (200, 201, 204, 206 and the 301/302/303/304/307/308 redirects). Error responses go out with no policy. Use `always`.
- Nginx cannot generate a per-request nonce on its own. Nonce-based policies need the application, or a module such as njs or Lua. Allowlist and hash-based policies are fine here.

## Official documentation

[Nginx - ngx_http_headers_module](https://nginx.org/en/docs/http/ngx_http_headers_module.html)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Prefer a guided setup? The [CSP Wizard](/setup/wizard/) builds a policy from your reports automatically once you're signed in.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)