---
description: How Adobe Commerce and Magento Open Source support Content Security Policy, and how to send CSP violation reports to Report URI.
---

# Adobe Commerce

Adobe Commerce and Magento Open Source have shipped native CSP support since 2.3.5 through the `Magento_Csp` module. You do not need an extension and you do not need to hand-write the header - the platform builds the policy for you and gives you a place to put your reporting endpoint.

Storefront and Admin are configured separately, which is worth knowing before you start wondering why a change had no effect on the page you were looking at.

## What Adobe Commerce gives you

- Two modes per area: **report-only**, where violations are reported but nothing is blocked, and **restrict**, where the browser enforces the policy. From 2.4.7 payment pages default to restrict and everything else defaults to report-only.
- `csp_whitelist.xml` for adding trusted domains to individual directives (`script-src`, `style-src`, `font-src` and the rest), or for allowing specific inline scripts and styles by SHA-256 hash.
- A CSP nonce provider from 2.4.7, so inline scripts can be allowed without `'unsafe-inline'`.
- Mode switching in `config.xml` via the `report_only` values, including per-page configuration.

## Sending reports to Report URI

Set your reporting endpoint in the Admin under **Stores > Configuration > Security > Content Security Policy**, or set it programmatically in `config.xml`. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page in your account and looks like this:

    https://abc123.report-uri.com/r/d/csp/reportOnly

Reports are sent in both modes, so you keep getting data after you switch a page from report-only to restrict. Use the `reportOnly` endpoint while a page is in report-only mode and the `enforce` endpoint once it is enforcing, so the two data sets stay separate in your account.

## Things to watch for

- Because payment pages default to restrict from 2.4.7 while everything else defaults to report-only, an upgrade can start blocking on checkout before you have tuned the policy. Review those pages first.
- Third-party extensions frequently inject their own scripts. Each one needs an entry in `csp_whitelist.xml`, and your CSP reports are the fastest way to find the ones nobody documented.
- Hashes in `csp_whitelist.xml` break whenever the inline script changes by a single character. Prefer the nonce provider on 2.4.7 and above.

## Official documentation

[Adobe Commerce - Content security policies](https://developer.adobe.com/commerce/php/development/security/content-security-policies)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Working towards PCI DSS 4.0 on your checkout? See our [Compliance](/compliance/) guides.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)