Work with security headers
If you want to increase the security of your Optimizely Configured Commerce site, you can use the Content-Security-Policy and Referrer-Policy headers.
📘 Note You must have the role of ISC_System or ISC_Implementer to edit these options.
You can find these settings under Administration > Settings > Site Configurations > Security Headers in the Admin Console.
- Content-Security-Policy acts as an added layer of security to prevent cross-site scripting (XSS), applied to storefront urls. See Mozilla's article on Content Security Policy for information. Since 5.2.2609, this defaults to object-src 'none'; base-uri 'self' instead of an empty string.
- Admin Content-Security-Policy applies the same kind of policy to the admin console and identity urls instead of the storefront policy. This is a global setting (not website-specific) and defaults to object-src 'none'; base-uri 'self'.
- Content-Security-Policy-Report-Only and Admin Content-Security-Policy-Report-Only send a policy that is reported on but not enforced, for the storefront and admin console/identity urls respectively. Use these to test a stricter policy before moving it into the enforced settings above. No header is sent while the value is empty (the default).
- Referrer-Policy controls how much referrer information (sent with the referer header) should be included with requests. See Mozilla's article on the Referrer-Policy for information. The default value is Strict Origin When Cross Origin.
A frame-ancestors directive is added to the enforced Content-Security-Policy and Admin Content-Security-Policy headers automatically, based on the X-Frame-Options setting, unless the policy already specifies its own frame-ancestors directive. This directive is omitted for PunchOut sessions and for the Content Admin's same-origin CMS preview frame, so those scenarios are not broken by a default policy.
❗️ Warning Incorrectly implementing this setting could break your website.