> For the complete documentation index, see [llms.txt](https://support.storefront.co.za/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.storefront.co.za/features/stores/store-settings/security-and-privacy/content-security-policy.md).

# Content security policy

A content security policy, or CSP, restricts which external sources your storefront is allowed to load from. It is a protection against a third party injecting content into your store, for example by loading a script you did not put there.

Your store ships with a working policy. These settings let you add the extra sources your own integrations need, such as a chat widget, an analytics tool or an embedded video.

### Settings

Each setting adds permitted sources for one kind of content:

* **Additional script-src** - scripts.
* **Additional style-src** - stylesheets.
* **Additional img-src** - images.
* **Additional connect-src** - connections your storefront makes in the background.
* **Additional frame-src** - embedded frames, such as videos or maps.
* **Additional font-src** - fonts.
* **Additional media-src** - audio and video files.
* **Additional worker-src** - background workers.
* **Additional form-action** - the destinations forms may submit to.
* **Additional frame-ancestors** - the sites permitted to embed your storefront.

### How to Add a Source

1. Select the store you would like to update
2. Click on Manage Store Settings underneath Settings
3. Open Security & Privacy
4. Open the Content security policy section
5. Add the source to the setting matching the kind of content it provides
6. Save your changes

{% hint style="warning" %}
Add only the sources you need. Each one you allow is another party your storefront trusts to load content. If a widget stops working after you add it to your store, a missing source here is a likely cause.
{% endhint %}

### Need Help?

If a third-party tool is not loading and you are unsure which source to add, please contact our support team.