Content Security Policies
TYPO3 Content Security Policies
Content Security Policies (CSP) in TYPO3 help protect your website from harmful content. By setting up CSP, you control which sources of content are allowed on your site. This means you can stop unauthorized scripts or resources from running, making your site more secure. It’s an easy way to keep your TYPO3 website safe and reliable!
A Content Security Policy, in German Inhalts-Sicherheitsrichtlinie, is a security mechanism that tells the browser from which sources scripts, images, fonts and other content may be loaded. It protects websites against attacks such as cross-site scripting and the injection of foreign content.
The policy is delivered as an HTTP header or meta tag and consists of rules such as script-src, img-src or frame-src. Anything not allowed is blocked by the browser. This limits damage even if attackers find a vulnerability.
TYPO3 supports content security policies in the backend and can configure them for the frontend. Extensions may bring their own rules. Especially in newer versions management has become considerably more convenient, and violations are logged.
Introduction should be gradual. Start in report-only mode to see which resources would be blocked without disturbing the page. Then adjust the rules and enforce them. External services such as analytics, maps or videos must be considered.
Avoid unsafe exceptions such as unsafe-inline where possible. Use nonces or hashes instead so that only verified code runs.
After every change, test the most important pages and functions, because rules that are too strict can impair display or forms.
Additional security headers such as X-Frame-Options or Strict-Transport-Security also help.
Document the policy and review it after integrating new services.
We set up security headers and content security policies in your TYPO3 project.
This noticeably increases the protection of your website.
Also involve service providers who integrate scripts so that rules and sources are coordinated early.