---
title: "Content Security Policy"
description: "1 posts about Content Security Policy, summarised, each linking to the original."
---

# Content Security Policy
> 1 posts about Content Security Policy, summarised, each linking to the original.

## Articles

### [Using HTTP Headers to Secure Your Site](https://yomu.fyi/post/using-http-headers-to-secure-your-site.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Caleb Hearth
- Published: Mar 1, 2018
- Type: Tutorial

A straightforward Static Buildpack app received an F, scoring 20/100 in Mozilla Observatory because several security response headers were missing, despite redirecting visitors to HTTPS with an Automated Certificate Management certificate. The walkthrough examines failures for Content Security Policy, HTTP Strict Transport Security, X-Content-Type-Options, X-Frame-Options and X-XSS-Protection, then configures them through the static.json headers collection. The CSP restricts resource origins, blocks inline scripts by default, and uses a SHA-256 hash to permit the Google Analytics inline script without adding unsafe-inline. HSTS uses max-age=63072000, includeSubDomains and optionally preload, while other headers supply MIME sniffing, iframe and legacy XSS protections. After the changes, the reported checks pass, the configuration reaches an A and is later described as A+; the final recommendation adds Referrer-Policy and omits opt-in HSTS preload.