Wannes Debusschere
CSP
Content-Security-Policy headers with per-request nonce for Kirby, following Google's strict CSP guidance.
Features
- Opt-in and per-host
- Disabled by default, enable per environment via config.{host}.php
- Report-only rollout
- Test a policy against real traffic before enforcing.
- Per-request nonce
- cspNonce() helper for inline scripts, Vite tags and third-party snippets.
- Panel-safe
- The header is only sent on frontend routes; Panel, API and media are left untouched.
Info
- Topics
