BigCommerce
BigCommerce lets you set a Content Security Policy for your storefront from the control panel, without a theme change or an app. It is a single field holding the policy value, so everything you want the browser to enforce has to fit in the one string.
What BigCommerce gives you
- A storefront CSP setting under Settings > Security & Privacy, alongside the other advanced security policies such as
X-Frame-Options. Managing storefront settings requires the Manage Channels permission. - The same setting exposed through the REST API as
csp_header, with anenabledflag and aheader_valuestring, so the policy can be managed in code alongside the rest of your store configuration. - Catalyst storefronts ship a default Content Security Policy that can be extended in the codebase rather than the control panel.
Sending reports to Report URI
Add a reporting directive to the policy value in the CSP field. Your URL comes from the Setup page:
default-src 'self'; report-uri https://abc123.report-uri.com/r/d/csp/enforce
Reports are sent by an enforcing policy as well as a report-only one, so you get data from the moment the header goes live.
Things to watch for
- The setting is for the
Content-Security-Policyheader and there is no documented report-only toggle. If you want a genuine report-only rollout first, addContent-Security-Policy-Report-Onlyin front of BigCommerce instead - see our Cloudflare page - and leave the control panel setting switched off until you have tuned the policy. - A safe way to start in the control panel is a deliberately permissive policy that still reports, so you collect an inventory of what your storefront loads before you tighten anything.
- Apps and script manager entries add third-party scripts that will not be in your policy. Expect the first few days of reports to be busy.
Official documentation
BigCommerce - Security and Privacy Settings
Start Monitoring with Report URI
Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.
New to Report URI? Create an account and grab your report-uri value from the Setup page.