Skip to main content
Through CSP management you control, via Content Security Policy, from which sources the browser is allowed to load content on your website, e.g. images, scripts, or fonts from external services. Each entry consists of a header type (what kind of content) and a header value (from which source).
A CSP protects your visitors by allowing only approved sources. If you embed external content and it is not displayed, the appropriate CSP header is usually missing.

​
CSP header list

Open Security & Privacy → CSP Management. The list shows the header value, header type, and active status for each entry. Using the toolbar, you create a header with + New, open it with Edit (or a double-click), and remove it with Delete. For filtering, you have the following at the top:
  • Show standard headers: Displays the preconfigured standard headers
  • Show all: Dropdown to narrow the list to a specific header type
  • Search: Full-text search across the entries

​
Creating a CSP header

Click + New. In the Create CSP header dialog, fill in the General section:
  • Header type: Type of content the rule applies to (selected via dropdown, see below)
  • Header value: Allowed source, e.g. a domain such as *.supabase.co. With 'none' you block the type entirely, with 'self' you allow only your own domain.
  • Active: The header is only delivered when the toggle is enabled
Save via Save or Save and close.

​
Header types

The header type determines which kind of resource the source applies to. The available options include, among others:
A detailed reference of all directives can be found in the MDN documentation on CSP.

​
Editing or deleting a CSP header

Open an entry with a double-click or via Edit. In the Edit CSP header dialog, you change the type, value, and active status, or remove the header at the top via Delete.

External content

Embed external content that must be approved via CSP.

Cookie providers

Manage providers for cookie consent.