Skip to content
MDView as Markdown

BigCommerce

BigCommerce lets you set a Content Security Policy for your storefront from the control panel, without a theme change or an app. It is a single field holding the policy value, so everything you want the browser to enforce has to fit in the one string.

What BigCommerce gives you

  • A storefront CSP setting under Settings > Security & Privacy, alongside the other advanced security policies such as X-Frame-Options. Managing storefront settings requires the Manage Channels permission.
  • The same setting exposed through the REST API as csp_header, with an enabled flag and a header_value string, so the policy can be managed in code alongside the rest of your store configuration.
  • Catalyst storefronts ship a default Content Security Policy that can be extended in the codebase rather than the control panel.

Sending reports to Report URI

Add a reporting directive to the policy value in the CSP field. Your URL comes from the Setup page:

default-src 'self'; report-uri https://abc123.report-uri.com/r/d/csp/enforce

Reports are sent by an enforcing policy as well as a report-only one, so you get data from the moment the header goes live.

Things to watch for

  • The setting is for the Content-Security-Policy header and there is no documented report-only toggle. If you want a genuine report-only rollout first, add Content-Security-Policy-Report-Only in front of BigCommerce instead - see our Cloudflare page - and leave the control panel setting switched off until you have tuned the policy.
  • A safe way to start in the control panel is a deliberately permissive policy that still reports, so you collect an inventory of what your storefront loads before you tighten anything.
  • Apps and script manager entries add third-party scripts that will not be in your policy. Expect the first few days of reports to be busy.

Official documentation

BigCommerce - Security and Privacy Settings

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page.

Start your free trial