Content-Security-Policy
This module helps protect your Drupal site from security threats like XSS by allowing you to specify trusted sources for external resources through the Content-Security-Policy header. It automatically generates a policy for JavaScript and CSS, is optimized for efficiency, and integrates with other modules for reporting policy violations.
The Content-Security-Policy header allows your Drupal site to inform browsers of trusted sources for JavaScript, CSS, and other external resources. This adds a security layer to detect and mitigate the risk of Cross Site Scripting (XSS), data injection, and other vulnerabilities.
Features
- Integrates with Drupal's Libraries API to automatically generate a default site-wide policy for JavaScript and CSS
- Up-to-date with the latest CSP Level 3 Working Draft
- Policy is automatically optimized to remove duplicate directives and reduce header length
- Dispatches an event to allow other modules to alter policies for each request
- Policy Violation logging integrations:
Depends on
Dependencies of the latest stable release
No dependencies recorded for this project.
Required by
1 tracked project depends on this one
- CSP Google Supported Domains 2 sites
Activity
Release Timeline
Releases
| Version | Type | Core | Notes | Release date | |
|---|---|---|---|---|---|
| 2.2.4 | Stable | 10–11 | Apr 28, 2026 | ||
| 2.2.3 | Stable | 11 | Apr 20, 2026 | ||
| 2.2.2 | Stable | 10–11 | Mar 12, 2025 | ||
| 8.x-1.40 | Stable | 10–11 | Mar 12, 2025 | ||
| 2.2.1 | Stable | 10–11 | Jan 11, 2025 | ||
| 2.2.0 | Stable | 10–11 | Jan 7, 2025 | ||
| 2.2.0-rc1 | Pre-release | 10–11 | Config Schema Validation | Dec 2, 2024 | |
| 2.1.1 | Stable | 10–11 | Oct 9, 2024 |