Skip to content
MDView as Markdown

Platforms

Most of the platforms you already run support Content Security Policy. Some ship it turned on, some hide it behind a checkbox in an admin screen, and some publish a list of domains you have to allow before their scripts will load at all.

These pages are short orientation guides. For each platform we cover what it actually gives you, where the reporting endpoint goes, and what tends to catch people out - then we point you at the vendor's own documentation, which is always the authority.

Ecommerce and CMS

  • Adobe Commerce - the Magento_Csp module, report-only vs restrict mode, and the report-uri field in the Admin
  • Shopify - CSP in Hydrogen, and what you can and cannot control on a hosted storefront
  • BigCommerce - the storefront CSP header setting in the control panel
  • Dynamics 365 Commerce - CSP is on by default, with report-only and nonce toggles in site builder
  • WordPress - an honest look at a platform with no official CSP support at all

Tags and analytics

  • Google Tag Manager - nonce support, per-product domains, and why Custom JavaScript is a problem
  • Adobe Experience Platform Tags - passing a nonce to the Core extension
  • Tealium - data centre domains, and the vendors loaded through your tag manager
  • Segment - Analytics.js, device-mode destinations and the first-party domain option
  • New Relic - why the browser agent asks for 'unsafe-inline', and how to avoid giving it

Advertising

Payments

  • Stripe - the directives Stripe.js needs, including 3D Secure
  • Adyen - Adyen's own script security guidance for PCI DSS 6.4.3 and 11.6.1
  • Braintree - the full directive set, and why 3D Secure forces a wildcard
  • PayPal - the JS SDK's domains and its data-csp-nonce attribute
  • Square - the Web Payments SDK, and why their <meta> tag examples cannot report
  • Mollie - three lines, and a vendor that tells you to run a strict CSP

Support and messaging

  • Intercom - full strict CSPv3 support, with an allowlist fallback
  • Zendesk - built around Google's strict CSP guidance

CDN and edge

  • Cloudflare - adding a CSP header at the edge when your platform will not let you
  • AWS CloudFront - and why the managed security headers policy does not include a CSP
  • Netlify - per-request nonces on a static site, via edge functions
  • Fastly - setting the header in VCL at the edge

Setting the header from your own application instead? The Frameworks guides cover Django, Rails, Laravel, Express, Next.js, Spring Boot, ASP.NET Core, Nginx, Apache and IIS.

New to CSP itself? Start with our Content Security Policy guide and the CSP Wizard, then come back here for the platform-specific detail.

Vendors change their guidance without notice. Always check the official documentation we link to before you deploy a policy, and roll it out in report-only mode first.