A module for CSP headers in Silverstripe.

Installs: 1 279

Dependents: 0

Suggesters: 0

Security: 0

Stars: 2

Watchers: 16

Forks: 1

Open Issues: 2


0.1.2 2021-11-16 23:33 UTC

This package is not auto-updated.

Last update: 2023-01-25 05:22:06 UTC


Make your site like super secure with CSP headers and SRI tags on your scripts.

This module is not currently supported, it will frequently change and break APIs.


  • SilverStripe ^4 (Developed against 4.7 no guarantees to older versions)


First you install it, then you configure it. Like lego!

composer require silverstripeltd/silverstripe-csp


First you're going to want to create a Policy you'll likely want to extend the Basic policy as a good starting ground.

This will look something like:

class ContentSecurityPolicy extends Basic
    public function configure(): void

You can then start adding in fragments. These are small pieces of code that resemble a CSP for a service. For example YouTube's is:

class YouTube implements Fragment
    public static function addTo(Policy $policy): void
            ->addDirective(Directive::SCRIPT, [
            ->addDirective(Directive::FRAME, "*");

If you need to add a new fragment or update an existing one please make a pull request to the repo. You've either found a potential issue for all our projects using this, or you're adding a new service which other project can benefit from

Adding fragments to your policy looks like this (in configure func from above):

public function configure(): void

Usually you'll define private const FRAGMENTS = [] and add them in there so it's clear at the beginning what fragments you're adding.

To set the report to, we usually use an env var named CSP_REPORT_TO. You can also call $this->reportTo() in your policies configure func if required (perhaps you want the report URI based on the policy applied).

To add the policy to the list of applied policies you'll want to add some yaml config:

    - 'Silverstripe\CSP\Policies\CMS'
    - 'App\ContentSecurityPolicy'

In the above we've added it to be checked after the CMS policy that is included by default.

To make the policy report only you can either add the env var CSP_REPORT_ONLY='enabled' or code it in your policy, for example:

public function configure(): void
    if (Director::isDev()) {

Google Tag Manager / Adservices whitelist

Google uses localised regional domains for visitors for image tracker loading, which can pile up report violations with|| etc in your reporting tool. To resolve this and rather than specifying all of Google's listed support domains (see A white list config can be set to the GTM fragment to whitelist all https: URLs on the img-src directive, for example:

  whitelist_google_regional_domains: true

See also ImagesOverHTTPs::class for more basic cover of https images.


We also support SRI in this module, you can enable this via yaml:

  sri_enabled: true

This will add SRI hashes to resources added through the requirements. It will not do this to the resources added through insertHeadTags. It will also not create this for files that are dynamically created (e.g. tinymce files)

We won't add SRI hashes for external resources, if this is required then you should be adding them in yourself after being provided them by the external resource (we don't do this as we can't control when or how often those are recalculated)

dev/build will clear the SRI records (we keep these to ensure we don't generate them per request). This has been added through the DevBuildExtension

Todo list:

  • Add the ability to hash inline scripts (this would sit in CSPBackend)
  • Add Google analytics and tag manager (this will happen shortly)
  • Add unit tests



Bugs are tracked in the issues section of this repository. Before submitting an issue please read over existing issues to ensure yours is unique.

If the issue does look like a new bug:

  • Create a new issue
  • Describe the steps required to reproduce your issue, and the expected outcome. Unit tests, screenshots and screencasts can help here.
  • Describe your environment as detailed as possible: SilverStripe version, Browser, PHP version, Operating System, any installed SilverStripe modules.

Please report security issues to the module maintainers directly. Please don't file security issues in the bugtracker.

Development and contribution

If you would like to make contributions to the module please ensure you raise a pull request and discuss with the module maintainers.


See License