Content security policy
A content security policy, or CSP, restricts which external sources your storefront is allowed to load from. It is a protection against a third party injecting content into your store, for example by loading a script you did not put there.
Your store ships with a working policy. These settings let you add the extra sources your own integrations need, such as a chat widget, an analytics tool or an embedded video.
Settings
Each setting adds permitted sources for one kind of content:
Additional script-src - scripts.
Additional style-src - stylesheets.
Additional img-src - images.
Additional connect-src - connections your storefront makes in the background.
Additional frame-src - embedded frames, such as videos or maps.
Additional font-src - fonts.
Additional media-src - audio and video files.
Additional worker-src - background workers.
Additional form-action - the destinations forms may submit to.
Additional frame-ancestors - the sites permitted to embed your storefront.
How to Add a Source
Select the store you would like to update
Click on Manage Store Settings underneath Settings
Open Security & Privacy
Open the Content security policy section
Add the source to the setting matching the kind of content it provides
Save your changes
Add only the sources you need. Each one you allow is another party your storefront trusts to load content. If a widget stops working after you add it to your store, a missing source here is a likely cause.
Need Help?
If a third-party tool is not loading and you are unsure which source to add, please contact our support team.