Magento 2 Content Security Policy (CSP): From Report-Only to Enforced
Content Security Policy (CSP) is the single most effective browser-level defence against Magecart skimmers — it tells the browser exactly which scripts are allowed to run, so an injected one simply doesn't. Magento 2 ships CSP, but by default it's in report-only mode, which watches without blocking. This guide walks from report-only to an enforced, skimmer-stopping policy.
First, see whether your storefront's headers are helping or hurting: run a free MageArgus scan to check your CSP and other security headers.
- Magento ships CSP in report-only mode since 2.4.7 — Adobe Commerce docs
- An enforced script-src allow-list blocks injected checkout scripts outright — OWASP
Why report-only isn't enough
Report-only CSP sends you violation reports but allows every script to run — including a skimmer. It's a tuning phase, not a defence. The protection only kicks in when you switch to enforced mode with a curated allow-list.
Step 1 — collect what legitimately loads
Leave CSP in report-only for a week and gather the violation reports (or read the browser console on key pages). Build a list of the hosts your store genuinely needs: your domain, payment gateway (PayPal/Stripe/etc.), analytics/tag manager, fonts and CDNs.
Step 2 — define the policy in Magento
Magento's CSP is configured per-area via a module's csp_whitelist.xml. Add each required host under the correct policy (e.g. script-src, connect-src), keeping the list as tight as possible — especially on checkout.
<policy id="script-src">
<values>
<value id="paypal" type="host">*.paypal.com</value>
</values>
</policy>Step 3 — switch to enforced
Once reports are quiet, flip the mode from report-only to enforced (via Magento\Csp configuration / the Csp module settings). Test checkout thoroughly — a broken allow-list can block legitimate payment scripts, so verify PayPal/Stripe still load before going live.
Step 4 — keep it tight
Avoid 'unsafe-inline' and wildcards in script-src where you can — they defeat the point. Add frame-ancestors and form-action too. Pair CSP with Subresource Integrity on third-party scripts. See security headers explained and Magecart protection.
Frequently asked questions
Will enforcing CSP break my store?
It can if the allow-list is incomplete — legitimate scripts get blocked. That's why you run report-only first, collect every host your store needs, then enforce and test checkout before going live.
Does CSP replace patching?
No. CSP is a strong second layer that stops injected scripts from executing, but you still need to patch the vulnerability that let an attacker inject in the first place. Use both.