Getting started

Install the plugin and visit the CSP page in the backend settings. Configure the CSP according to your needs.

By default, a strict policy is set. We suggest you make your page work with this preset for optimal security.

We suggest that you start in Report only mode. This will generate console messages and a log entry for each validation of the CSP.

You can visit the log via the backend settings. You will find a log entry for every violation generated by your site. Tune your CSP until no more violations are logged.

Now you are ready to disable the Report only mode and actually block violating requests.

Adding the CSP as a meta tag

If you don't want to add the CSP header to every response, you can opt-in for certain pages by adding this meta tag:

<meta http-equiv="content-security-policy" content="{{ csp_meta() }}">

Make sure to disable the global response header in the backend settings first. Also note, that the reporting of violations is not supported using the meta tag method (they are logged to your browser console but not to the database).

Test your CSP

You can test the strength of your CSP using Google's CSP validator or the Mozilla Observatory.

Using the nonce on demand

You can access the nonce for the current request using the csp_nonce() helper function:

<script nonce="{{ csp_nonce() }}"></script>
<style nonce="{{ csp_nonce() }}"></style>

You can enable or disable the automatic injection of the nonce via the backend settings.

When things break

A misconfigured CSP can break your site. Make sure to work in Report only mode until you have fine-tuned your site to your CSP.

If for any reason you are unable to access your site after you enabled the CSP, you can run the following console command to disable the CSP header injection completely:

php artisan csp:disable