---
schema_version: "1"
id: 05a66871c6d2a810c45ac3b0df1e3ea8407e8c5a9d9976f6f671f548c3d7d28b
title: CSP and Lightning Locker in Experience Builder Sites
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/experience/264-0-0/networks_security_csp_overview.md
canonical_url: https://help.salesforce.com/s/articleView?id=experience.networks_security_csp_overview.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 52af9c540d0d2dbcb7cf58a29df052ac5f567b0ac7f0bb3a7ca9f7905468b56e
description: Experience Builder sites use Content Security Policy (CSP) and Lightning Locker to secure your site from malicious attacks and custom code vulnerabilities. CSP is a W3C standard that controls the source of content that can be loaded on your site’s pages and helps protect against cross-site scripting (XSS) attacks. Lightning Locker is a Salesforce architectural layer that allows third-party Lightning components and custom code to run safely on the same page in the browser. With different levels of security, you can optimize your site security choices and tolerance for risk.
products:
  - Experiences
release: "264"
---
# CSP and Lightning Locker in Experience Builder Sites

Experience Builder sites use Content Security Policy (CSP) and Lightning Locker to secure your site from malicious attacks and custom code vulnerabilities. CSP is a W3C standard that controls the source of content that can be loaded on your site’s pages and helps protect against cross-site scripting (XSS) attacks. Lightning Locker is a Salesforce architectural layer that allows third-party Lightning components and custom code to run safely on the same page in the browser. With different levels of security, you can optimize your site security choices and tolerance for risk.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Essentials</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_note.png)

Note By default, sites created before the Spring ’19 (February 2019) release use the Allow Inline Scripts and Script Access to Any Third-party Host setting. In Spring ’22 (February 2022), that option is being removed for those sites. We strongly recommend updating your script security level and testing your site before that option expires.

For new sites created after the Spring ’19 release, Strict CSP is the default CSP setting.

## What Is CSP?

CSP is a list of rules that define the Content-Security-Policy HTTP header that’s sent to the browser when someone visits your site. Web browsers use these rules to block requests to unknown servers for different kinds of resources such as scripts, images, and other data. Strict CSP makes your site the most secure against these kinds of attacks by preventing requests to other servers, unless explicitly allowed.

CSP determines what is part of your site and what isn’t. One of the most important aspects of CSP is how it defines the boundaries of your site. Anything not loaded through your site's domain name, such as a logo hosted on a separate company site, is considered a third-party host. This approach to CSP follows the same-origin policy that browsers already enforce. You can access third-party hosted materials, but you must choose a security level for your site first. Then, allow the hosts as appropriate.

## What Is Lightning Locker?

Lightning Locker is a Salesforce architectural layer that enhances the security of the third-party Lightning components in your site and custom code in your `head` markup. These third-party components and custom code can contain security vulnerabilities that enable the exfiltration of data and potentially malicious actions using that data.

Lightning Locker controls whether third-party components and custom code from different namespaces can share data or interfere with each other. If third-party components or custom code deals with sensitive data, communication between these resources is a special concern. For example, without Lightning Locker, a third-party component could include JavaScript that captures secure data that a customer enters in another component, and then send that data to their own servers. Lightning Locker ensures that third-party components and custom code that interacts with resources in other namespace can run safely even when together on the same page in the browser.

Lightning Locker:

- Uses containers to isolate all third-party components that belong to one namespace from third-party components in a different namespace.
- Enforces coding best practices by only allowing access to supported APIs and eliminating access to non-published frameworks.
- Turns on native security features in the browser.

By default, Lightning Locker is turned on for your site. Depending on your security level, you can choose to turn off Lightning Locker for all third-party components and custom code.

## Security Levels

You can choose from these security levels.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d45103e124">Security Level</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d45103e127">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Security Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d45103e124 ">Strict CSP: Block Access to Inline Scripts and
              Permits
              Access to Allowed Hosts</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d45103e127 ">
              <p>Default setting for sites created in Spring ’19 (February 2019) and
                later.</p>
              <div>
                <p>Provides maximum security.</p>
                <ul>
                  <li>Blocks the execution of all inline scripts and all requests for remote JavaScript
                    files
                    unless explicitly allowed.</li>
                  <li>Allows the display of non-script resources, such as images, from third-party
                    hosts that are explicitly allowed.</li>
                  <li>Lightning Locker is turned
                    on
                    automatically, but can be turned off.</li>
                </ul>
              </div>
            </td>

          </tr>
          <tr class="">
            <td data-label="Security Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d45103e124 ">Relaxed CSP: Permit Access to Inline Scripts and Allowed Hosts</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d45103e127 ">
              <p>Provides moderate security. </p>
              <ul>
                <li>Allows inline scripts to run in your site.</li>
                <li>Allows the loading of remote JavaScript files and the display of non-script
                  resources, such as images, from third-party hosts that are explicitly
                  allowed.</li>
                <li>Lightning
                  Locker is
                  turned on automatically, but can be turned off.</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Security Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d45103e124 ">Allow Inline Scripts and Script Access to Any Third-party Host</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d45103e127 ">
              <p>Provides no added security, but enables your site to work as currently
                designed. </p>
              <ul>
                <li>Blocks nothing.</li>
                <li>Allows access to all third-party hosts without the need to explicitly allow
                  those hosts.</li>
                <li>Lightning Locker is turned on and can’t be disabled.</li>
              </ul>
              <div class="slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium">
                <div class="slds-media slds-media_responsive">
                  <div class="slds-media__figure"><span class="slds-icon_container slds-icon_container_circle slds-icon-note-note"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_note.png" alt="Note"></span></div>
                  <div class="slds-media__body" style="padding-top:.5rem;padding-bottom:.5rem;"><span class="slds-text-title_caps">Note</span> This option is only visible for sites created before Spring ’19. In
                    Spring ’22 (February 2022), this option is being removed.</div>
                </div>
              </div>
            </td>

          </tr>
        </tbody>
      </table>

- **[CSP and Lightning Locker Design Considerations](https://help.salesforce.com/s/articleView?id=experience.networks_security_csp_tips.htm&release=264.0.0&type=5)**  
    Whether you’re an administrator, content manager, or developer, be aware of the impact of the different security levels on your Experience Builder site. This impact can be far-ranging and unexpected.
- **[Where to Allowlist Third-Party Hosts for Experience Builder Sites](https://help.salesforce.com/s/articleView?id=experience.networks_security_csp_allow.htm&release=264.0.0&type=5)**  
    Regardless of your security level, you must allowlist all non-script resources such as images, style sheets, and fonts that are hosted outside your Experience Builder site. And if you reference external JavaScript files in your site, you must allowlist these remote hosts.
- **[Select a Security Level in Experience Builder Sites](https://help.salesforce.com/s/articleView?id=experience.networks_security_csp_scriptlevel.htm&release=264.0.0&type=5)**  
    Choose a security level to control whether scripts can be executed from your Experience Builder site and whether third-party components and custom code can share data.

#### See Also

- [_Experience Cloud Developer Guide:_ Enable Third-Party Components to Run When Lightning Locker Is Off](https://developer.salesforce.com/docs/atlas.en-us.communities_dev.meta/communities_dev/communities_dev_security_components.htm)
- [_Lightning Web Components Dev Guide:_ Security with Lightning Locker](https://developer.salesforce.com/docs/component-library/documentation/en/lwc/security_locker_service)
- [_Lightning Aura Components Developer Guide:_ Developing Secure Code](https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/security_intro.htm)
- [Static Resources](https://help.salesforce.com/s/articleView?id=platform.pages_static_resources.htm&type=5&language=en_US)