Security Small

Let the CSP allow what the page loads, or stop loading it

An enforcing Content-Security-Policy refuses every request its directives do not allow, including the site's own choices: an analytics pixel, a font stylesheet, a vendor's redirect to a host nobody listed. The browser logs each refusal as a console error and the request fails, so on a scan or in the network tab it looks like broken code or a service that is down. The fix is in the policy, one directive at a time.

Find out whether your site has this problem, and every other check, in one free scan.

Check your site free

Why it matters

A request the page's own Content-Security-Policy blocks never arrives: an analytics pixel stops counting, a font falls back, a widget stays empty. The browser logs it as an error, which reads like a bug in the code or a service being down, when the cause is one line in the policy.

How to fix

1 Read the blocked host and the directive beside it in the finding (img-src, style-src, connect-src and so on).
2 If the page needs it, add that host to that directive only, not to default-src and never as a wildcard. A vendor's documentation usually lists every host its tag calls, including redirects (Microsoft Clarity's pixel redirects to c.bing.com, for example).
3 If nothing on the page needs it, remove the tag, link or code that makes the call.

Common mistakes

Adding the blocked host to default-src, or allowing a wildcard such as https:, which widens the whole policy to fix one tag.
Allowing only the host a vendor's snippet names and missing the hosts it redirects to (Clarity's pixel redirects to c.bing.com).
Treating the console errors as a bug in the site's code or a vendor outage and chasing it there.

How to verify

1 Reload the page with the console open and confirm no "violates the following Content Security Policy directive" error is left.
2 Check the vendor's dashboard (or the network tab) to confirm its requests now arrive.
3 Re-scan: the CSP finding passes once nothing the page loads is blocked.

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site