---
description: How to set a Content Security Policy on a BigCommerce storefront and send CSP violation reports to Report URI.
---

# BigCommerce

BigCommerce lets you set a Content Security Policy for your storefront from the control panel, without a theme change or an app. It is a single field holding the policy value, so everything you want the browser to enforce has to fit in the one string.

## What BigCommerce gives you

- A storefront CSP setting under **Settings > Security & Privacy**, alongside the other advanced security policies such as `X-Frame-Options`. Managing storefront settings requires the Manage Channels permission.
- The same setting exposed through the REST API as `csp_header`, with an `enabled` flag and a `header_value` string, so the policy can be managed in code alongside the rest of your store configuration.
- Catalyst storefronts ship a default Content Security Policy that can be extended in the codebase rather than the control panel.

## Sending reports to Report URI

Add a reporting directive to the policy value in the CSP field. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    default-src 'self'; report-uri https://abc123.report-uri.com/r/d/csp/enforce

Reports are sent by an enforcing policy as well as a report-only one, so you get data from the moment the header goes live.

## Things to watch for

- The setting is for the `Content-Security-Policy` header and there is no documented report-only toggle. If you want a genuine report-only rollout first, add `Content-Security-Policy-Report-Only` in front of BigCommerce instead - see our [Cloudflare](/platforms/cloudflare/) page - and leave the control panel setting switched off until you have tuned the policy.
- A safe way to start in the control panel is a deliberately permissive policy that still reports, so you collect an inventory of what your storefront loads before you tighten anything.
- Apps and script manager entries add third-party scripts that will not be in your policy. Expect the first few days of reports to be busy.

## Official documentation

[BigCommerce - Security and Privacy Settings](https://support.bigcommerce.com/s/article/Security-and-Privacy-Settings)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)