Why it matters
Security headers are a few lines of server configuration that stop whole classes of attack: injected scripts, clickjacking, downgrades to unencrypted HTTP, and pages leaking their address to other sites. They cost nothing, but most small business sites send none of them.
The Content-Security-Policy is the most powerful and the easiest to get wrong, because it must list every service your site loads from. Starting from a strict policy and ticking the services you use gets you most of the way, and report-only mode lets you test without breaking anything.
How to use it
- Tick the services your site uses, then adjust any directive by hand.
- Set HSTS, Referrer-Policy and the browser features to switch off.
- Read the checks and fix anything in red.
- Copy the block for your server. Start in report-only mode, then switch it on.
FAQ
Will a CSP break my site?
It can, if it misses a service you use. That's why there's a report-only mode: browsers report what would be blocked in the console without blocking it.
Should I tick HSTS preload?
Only once every subdomain works over HTTPS and you're sure you'll never need plain HTTP. Removal from the preload list takes months.
Why not use 'unsafe-inline'?
It allows any inline script to run, including injected ones, which removes most of the protection a CSP gives. Move scripts into files instead.
How do I check my headers after publishing?
Open your browser's developer tools, reload, and look at the response headers for the page, or use a free scanner such as Mozilla's HTTP Observatory.
