---
schema_version: "1"
id: d2b10df73aac784669a9a8ecae11268c610636492ea467af007e30b997552461
title: Select a Security Level in Experience Builder Sites
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/experience/264-0-0/networks_security_csp_scriptlevel.md
canonical_url: https://help.salesforce.com/s/articleView?id=experience.networks_security_csp_scriptlevel.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e6fecbf08be89ad8cf85bfa1a82bf65714576d52da6bfbf17ee0c26ac5740a79
description: Choose a security level to control whether scripts can be executed from your Experience Builder site and whether third-party components and custom code can share data.
products:
  - Experiences
release: "264"
---
# Select a Security Level in Experience Builder Sites

Choose a security level to control whether scripts can be executed from your Experience Builder site and whether third-party components and custom code can share data.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Essentials</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d24722e73">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e73 ">To customize or publish an Experience Cloud site:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e73 ">
              <ul>
                <li>Create and Set Up Experiences AND View Setup and Configuration AND be a member
                  of the site<p>OR</p>
                </li>

                <li>View Setup and Configuration AND be a member of the site AND have appropriate
                  <a href="https://help.salesforce.com/s/articleView?id=experience.networks_access_control_overview.htm&amp;language=en_US" target="_blank">role-based site access</a>
                </li>

              </ul>
            </td>

          </tr>
        </tbody>
      </table>

Selecting a security level depends on your needs and tolerance for risk. We recommend running Strict CSP for optimum security. You can easily switch between levels to test how different security levels affect your customers’ experience.

1. In Experience Builder, open **Settings** | **Security & Privacy**.
    
    ![Security tab in Builder Settings](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/communities/images/experience_builder_csp.png)
2. Select a security level.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
            <colgroup>
              <col style="width:50%">
              <col style="width:50%">
            </colgroup>
            <thead class="slds-text-title_caps ">
              <tr class="">
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d24722e149">Security Level</th>
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d24722e152">Description</th>
              </tr>
            </thead>
            <tbody>
              <tr class="">
                <td data-label="Security Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e149 ">Strict CSP: Block Access to Inline Scripts and
                  Permits
                  Access to Allowed Hosts</td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e152 ">
                  <p>Default setting for sites created in Spring ’19 (February 2019) and
                    later.</p>
                  <div>
                    <p>Provides maximum security.</p>
                    <ul>
                      <li>Blocks the execution of all inline scripts and all requests for remote JavaScript files
                        unless
                        explicitly allowed.</li>
                      <li>Allows the display of non-script resources, such as images, from
                        third-party hosts that are explicitly allowed.</li>
                      <li>Lightning Locker is turned
                        on
                        automatically, but can be turned off.</li>
                    </ul>
                  </div>
                </td>

              </tr>
              <tr class="">
                <td data-label="Security Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e149 ">Relaxed CSP: Permit Access to Inline Scripts and Allowed Hosts</td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e152 ">
                  <p>Provides moderate security. </p>
                  <ul>
                    <li>Allows inline scripts to run in your site.</li>
                    <li>Allows the loading of remote JavaScript files and the display of
                      non-script resources, such as images, from third-party hosts that are
                      explicitly allowed.</li>
                    <li>Lightning
                      Locker is turned on automatically, but can be turned
                      off.</li>
                  </ul>
                </td>

              </tr>
              <tr class="">
                <td data-label="Security Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e149 ">Allow Inline Scripts and Script Access to Any Third-party Host</td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d24722e152 ">
                  <p>Provides no added security, but enables your site to work as currently
                    designed. </p>
                  <ul>
                    <li>Blocks nothing.</li>
                    <li>Allows access to all third-party hosts without the need to explicitly
                      allow those hosts.</li>
                    <li>Lightning Locker is turned on and can’t be disabled.</li>
                  </ul>
                  <div class="slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium">
                    <div class="slds-media slds-media_responsive">
                      <div class="slds-media__figure"><span class="slds-icon_container slds-icon_container_circle slds-icon-note-note"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_note.png" alt="Note"></span></div>
                      <div class="slds-media__body" style="padding-top:.5rem;padding-bottom:.5rem;"><span class="slds-text-title_caps">Note</span> This option is only visible for sites created before Spring ’19. In
                        Spring ’22 (February 2022), this option is being removed.</div>
                    </div>
                  </div>
                </td>

              </tr>
            </tbody>
          </table>
3. If you use non-script resources hosted outside Salesforce, such as images or style sheets, add the hosts to Trusted URLs in Setup. See [Manage Trusted URLs](https://help.salesforce.com/s/articleView?id=xcloud.security_trusted_urls_manage.htm&type=5&language=en_US).
    
    Hosts allowed in Trusted URLs are available to Lightning Experience, Experience Builder sites, or both, depending on the context you apply. If available to Experience Builder sites, that host is allowed for all sites in your Salesforce org.
4. If you use script resources hosted outside Salesforce, you can select either Strict CSP or Relaxed CSP, and allow the third-party hosts in the Trusted Sites for Scripts area that appears.
    
    ![Security tab with CSP details](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/communities/images/experience_builder_csp_trusted_sites.png)
    
    1. Click **Add Trusted Site**.
    2. Enter a friendly name and the resource URL.
        
        For added security, include the entire URL path to the resource folder—for example, https://www.example.com/logos/. Use the syntax https://site\_url/resource\_folder/, and ensure that the URL ends in /. If you add the URL for the whole domain rather than a specific resource folder, you extend trust to all resources on that domain, which can introduce a security vulnerability.
    3. Click **Add Site**.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_note.png)
    
    Note
    
    - Allowed external sites are specific to each Experience Builder site.
    - You can activate or deactivate a trusted site for easy testing and maintenance, without having to remove it from your site configuration.
5. Optionally, you can turn off Lightning Locker.
    
    Sometimes it’s necessary to turn off Lightning Locker to use custom components that automatically inject additional third-party JavaScript into the page, including the site’s `head` markup.
    
    ![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_warning.png)
    
    Warning Turning off Lightning Locker can potentially cause security flaws in your site and prevent third-party Aura components from being available at design time and rendering at runtime. Disable Lightning Locker only as a last resort. See [Enable Third-Party Components to Run When Lightning Locker Is Off](https://developer.salesforce.com/docs/atlas.en-us.communities_dev.meta/communities_dev/communities_dev_security_components.htm) and [Resolve Lightning Locker Conflicts in Experience Builder](https://developer.salesforce.com/docs/atlas.en-us.communities_dev.meta/communities_dev/communities_dev_security_limitations.htm) in the Experience Cloud Developer Guide.
6. Publish your site.