---
title: "How to Fix Content Security Policy (CSP) Magento 2"
url: "https://dolphinwebsolution.com/fix-content-security-policy-magento2-3-5"
date: "2021-03-27T06:59:30+05:30"
modified: "2023-08-31T05:19:48+05:30"
author:
name: "Chirag Parmar"
categories:
- "Magento"
tags:
- "Blocked Resources"
- "Content Security Policy"
- "Content Security Warning"
- "CSP"
- "Magento 2"
- "Magento 2.3.5"
word_count: 1428
reading_time: "8 min read"
summary: "Magento 2.3.5 introduced a new feature called “Content Security Policy (CSP)” to provide additional layers of defense for Magento installations by helping to detect and mitigate Cross-Site Scri..."
description: "Magento 2.3.5 introduced a new feature called “Content Security Policy (CSP)” to provide additional layers of defense for Magento installations by helpin..."
keywords: "content security policy,csp,magento2,Content Security Policy Magento,fix Content Security Policy, Blocked Resources, Content Security Policy, Content Security Warning, CSP, Magento 2, Magento 2.3.5"
language: "en"
schema_type: "Article"
related_posts:
- title: "Migration to Magento 2: Why is it so essential?"
url: "https://dolphinwebsolution.com/migrate-to-magento-2-why-is-it-so-essential"
---
# How to Fix Content Security Policy (CSP) Magento 2
_Published: March 27, 2021_
_Author: Chirag Parmar_
Magento 2.3.5 introduced a new feature called “Content Security Policy (CSP)” to provide additional layers of defense for [Magento installations](https://dolphinwebsolution.com/how-to-create-install-upgrade-uninstall-script-in-magento-2) by helping to detect and mitigate Cross-Site Scripting (XSS) and related data injection attacks. Contact Dolphin Web Solution for [**Magento 2 development**](https://dolphinwebsolution.com/magento-2-development/).
### Content Security Policy (CSP) can work in two modes:
- report-only – In this mode, Magento reports policy violations but does not interfere. This mode is useful for debugging. By default, CSP violations are written to the browser console, but they can be configured to be reported to an endpoint as an HTTP request to collect logs. There are a number of services that will collect, store, and sort your store’s [CSP violations](https://developer.adobe.com/commerce/php/development/security/content-security-policies/) reports for you.
- restrict mode – In this mode, Magento acts on any policy violations.
By default, CSP is configured in report-only mode, which allows merchants and developers to configure policies to work according to their custom code. After the policies have been configured, switch the mode to restrict.
### How it affect ?
When some resources from magento tries to include or execute an external site’s file/property then magento block it from loading immediately if it’s not whitelisted.
### How to Solve this issue?
Magento 2.3.5 added a new module module-csp ( Magento\_Csp ) which supports Content Security Policies ( CSP ) headers and provides ways to configure them. The policies can be configured for backend and frontend areas both.
You need to create below file in any of the modules which is enable. Let me show you by creating new module.
## Steps to whitelist your external resources in your Magento 2 Store:
#### 1) Register your module at Path :- app/code/Dolphin/Cspallow/registration.php
```
```
#### 3) Create csp\_whitelist.xml to whitelist properties in site at path:- app/code/Dolphin/Cspallow/etc/csp\_whitelist.xml
```
*.cloudflare.com
*.google-analytics.com
*.twimg.com
*.gstatic.com
*.trustedshops.com
*.usercentrics.eu
*.fontawesome.com
*.bing.com
*.zopim.com
*.zdassets.com
*.google.com
*.cloudflare.com
*.googleapis.com
*.twimg.com
*.gstatic.com
*.typekit.net
*.trustedshops.com
*.fontawesome.com
*.bing.com
*.cloudflare.com
*.klarna.com
*.googleadservices.com
*.google-analytics.com
*.paypal.com
*.twimg.com
*.vimeocdn.com
*.ytimg.com
'self' data:
*.bing.com
*.zopim.com
*.zopim.io
*.doubleclick.net
*.google.com
*.google.co.in
*.mastercard.com
www.google-analytics.com
*.cloudflare.com
*.paypal.com
*.twimg.com
*.zdassets.com
*.zopim.com
*.zopim.io
wss://widget-mediator.zopim.com
*.google-analytics.com
https://stats.g.doubleclick.net
*.cloudflare.com
*.gstatic.com
*.typekit.net
*.twimg.com
*.trustedshops.com
*.googleapis.com
*.zopim.com
*.zopim.io
https://www.youtube.com
http://www.sandbox.paypal.com
www.paypal.com
*.zopim.com
*.zopim.io
```
You can add your third party urls / domains to csp\_whitelist.xml.
For example if you are facing error like below :
```
Content Security Policy: The page’s settings blocked the loading of a resource at https://www.gstatic.com/recaptcha/releases/recaptcha__en.js (“script-src”).
```
The above error is related to “script” is blocking from google captcha provider. So You need to allow its whitelist code in csp\_whitelist.xml file mentioned as above. Let me show you how to add code for it.
```
*.gstatic.com
```
Do share your thoughts on Magento CSP in the Comments section below.
Thank you.
---
_View the original post at: [https://dolphinwebsolution.com/fix-content-security-policy-magento2-3-5](https://dolphinwebsolution.com/fix-content-security-policy-magento2-3-5)_
_Served as markdown by [Third Audience](https://github.com/third-audience) v3.5.3_
_Generated: 2026-08-26 07:38:02 UTC_