---
schema_version: "1"
id: 87f0a9c57273daaafc06121aa106c8e4efe8fae6ef504ddd1199603dd1290104
title: Content Security Policy (CSP) Configuration
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_content_security_policy.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_content_security_policy.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2b3c1e607652519d636b19c703414a0c9a817b73278db29dc4bfe3650f8351e3
description: Content Security Policy (CSP) is a security feature that you configure for your B2C Commerce storefront. When you implement CSP, you're responsible for making sure that your configuration enables the necessary scripts to run as intended.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Content Security Policy (CSP) Configuration

Content Security Policy (CSP) is a security feature that you configure for your B2C Commerce storefront. When you implement CSP, you're responsible for making sure that your configuration enables the necessary scripts to run as intended.

## What Is Content Security Policy?

Content Security Policy (CSP) is an HTTP response header that helps protect your storefront against Cross-Site Scripting (XSS) and other code injection attacks. With CSP, you control which scripts, styles, images, and other resources browsers can load on your pages.

When you configure CSP headers for your storefront, browsers enforce these policies by blocking any content that doesn't match your specified rules.

## Customer Responsibility for CSP

CSP configuration is your responsibility as a B2C Commerce customer. Salesforce doesn't manage or configure CSP on your behalf. You control which scripts, styles, and other resources can load on your storefront. Make sure your CSP configuration permits all necessary scripts to execute, including Salesforce-provided scripts and any third-party integrations. If your CSP is too restrictive, it can block scripts that your storefront requires to function properly.

## Scripts That Require CSP Consideration

When configuring your CSP, make sure that your policy allows the following types of scripts:

- **Salesforce analytics scripts** — Scripts such as `dwanalytics` that provide tracking and analytics functionality.
- **Inline scripts** — Scripts embedded directly in your HTML pages that are required for storefront functionality.
- **Einstein scripts** — Scripts that power Einstein recommendations, predictive sort, and other personalization features.

## Troubleshooting CSP Issues

If storefront features aren't working as expected, CSP restrictions can block required scripts. To diagnose CSP issues, open your browser's developer tools and check the Console tab for CSP violation errors. Then review the error messages to identify which scripts or resources the browser is blocking. Finally, update your CSP configuration to allow the blocked resources.

Work with your development team to review and adjust your CSP settings to allow all required scripts while maintaining appropriate security protections.

#### See Also

- [Declarative Security via HTTP Headers in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_declarative_security_via_http_headers.htm&release=264.0.0&type=5 "You can use declarative security controls as a strong line of defense against client browser-based attacks such as clickjacking and offer built-in browser protection against cross-site scripting (XSS). The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application.")
- [Cross-Site Scripting in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_cross_site_scripting.htm&release=264.0.0&type=5 "Cross-site scripting (XSS) enables attackers to inject client-side JavaScripts into a webpage viewed by a targeted user. To prevent malicious attacks through content manipulation, you must properly encode all user-provided content.")
- [Security Managed by Customer](https://help.salesforce.com/s/articleView?id=cc.b2c_security_managed_by_customer.htm&release=264.0.0&type=5 "Salesforce provides a variety of configurable security controls that authorized administrators can use to secure their instances on the Salesforce B2C Commerce platform. Customers can use additional controls to further customize their security footprint.")