Content Security Policies (CSPs)

A Content Security Policy (CSP) is an added layer of security that helps detect and mitigate certain types of attacks, including:

To learn more about configuring a CSP in general, refer to the Mozilla documentation ↗.

Using a CSP with Cloudflare

Cloudflare’s CDN is compatible with CSP.

Cloudflare does not:

Modify CSP headers from the origin web server (except when using Zaraz, to ensure the Zaraz script is always running ↗).
Require changes to acceptable sources for first or third-party content.
Modify URLs (besides adding the /cdn-cgi/ endpoint and Cloudflare Fonts that rewrites Google Fonts urls).
Interfere with locations specified in your CSP.

If you require the CSP headers to be changed or added, you can change them using some Cloudflare products:

If your website is proxied through Cloudflare, you can use a response header transform rule to replace or add CSP headers.
If your website is hosted using Cloudflare Pages, you can set a _headers file to modify or add CSP headers.

To use certain Cloudflare features, however, you may need to update the headers in your CSP:

Feature(s)	Updated headers
Rocket Loader, Mirage	`script-src 'self' ajax.cloudflare.com;`
Cloudflare Apps ↗, Scrape Shield	`script-src 'self' 'unsafe-inline'`
Web Analytics	`script-src static.cloudflareinsights.com; connect-src cloudflareinsights.com`
Bot products	Refer to JavaScript detections and CSPs.
Page Shield	Refer to Page Shield CSP Header format.
Zaraz	No updates required (details ↗).
Turnstile	Refer to Turnstile CSP.