This module helps protect your Drupal site from security threats like XSS by allowing you to specify trusted sources for external resources through the Content-Security-Policy header. It automatically generates a policy for JavaScript and CSS, is optimized for efficiency, and integrates with other modules for reporting policy violations.
The Content-Security-Policy header allows your Drupal site to inform browsers of trusted sources for JavaScript, CSS, and other external resources. This adds a security layer to detect and mitigate the risk of Cross Site Scripting (XSS), data injection, and other vulnerabilities.
Features
- Integrates with Drupal's Libraries API to automatically generate a default site-wide policy for JavaScript and CSS
- Up-to-date with the latest CSP Level 3 Working Draft
- Policy is automatically optimized to remove duplicate directives and reduce header length
- Dispatches an event to allow other modules to alter policies for each request
- Policy Violation logging integrations:
Ask your assistant about Content-Security-Policy
Check compatibility with your Drupal and PHP version, maintenance and security coverage, from current release data. How it works
Depends on
Dependencies of the latest stable release
No dependencies recorded for this project.
Required by
1 tracked project depends on this one
- CSP Google Supported Domains 2 sites
Activity
Release Timeline
Releases
| Version | Type | Core | PHP | Release date | |
|---|---|---|---|---|---|
| 8.x-1.31 | Stable | 10–11 | May 4, 2024 | ||
| 2.0.0-alpha1 | Pre-release | 10 | Feb 13, 2024 | ||
| 8.x-1.30 | Stable | 10 | Jan 19, 2024 | ||
| 2.x-dev | Dev | 11 | Jan 19, 2024 | ||
| 8.x-1.24 | Stable | 9–10 | PHP >=7.4 | Dec 23, 2023 | |
| 8.x-1.23 | Stable | 9–10 | PHP >=7.4 | Dec 13, 2023 | |
| 8.x-1.22 | Stable | 9–10 | PHP >=7.4 | Nov 16, 2023 | |
| 8.x-1.21 | Stable | 9–10 | PHP >=7.4 | Sep 22, 2023 | |
| 8.x-1.20 | Stable | 9–10 | PHP >=7.2 | Jul 3, 2023 | |
| 8.x-1.19 | Stable | 9–10 | PHP >=7.2 | Apr 8, 2023 |