---
title: Work with security headers
slug: configured-commerce/docs/work-with-security-headers
docTags: 
createdAt: 2026-08-13T10:46:28.000Z
---

If you want to increase the security of your Optimizely Configured Commerce site, you can use the Content-Security-Policy and Referrer-Policy headers.

:::hint{type="info"}
**📘 Note**
You must have the role of ISC\_System or ISC\_Implementer to edit these options.
:::

You can find these settings under **Administration** > **Settings** > **Site Configurations** > **Security Headers** in the Admin Console.

- **Content-Security-Policy** acts as an added layer of security to prevent cross-site scripting (XSS), applied to storefront urls. See [Mozilla's article on Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) for information. Since 5.2.2609, this defaults to `object-src 'none'; base-uri 'self'` instead of an empty string.
- **Admin Content-Security-Policy** applies the same kind of policy to the admin console and identity urls instead of the storefront policy. This is a global setting (not website-specific) and defaults to `object-src 'none'; base-uri 'self'`.
- **Content-Security-Policy-Report-Only** and **Admin Content-Security-Policy-Report-Only** send a policy that is reported on but not enforced, for the storefront and admin console/identity urls respectively. Use these to test a stricter policy before moving it into the enforced settings above. No header is sent while the value is empty (the default).
- **Referrer-Policy** controls how much referrer information (sent with the `referer` header) should be included with requests. See [Mozilla's article on the Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) for information. The default value is **Strict Origin When Cross Origin**.

A `frame-ancestors` directive is added to the enforced Content-Security-Policy and Admin Content-Security-Policy headers automatically, based on the **X-Frame-Options** setting, unless the policy already specifies its own `frame-ancestors` directive. This directive is omitted for PunchOut sessions and for the Content Admin's same-origin CMS preview frame, so those scenarios are not broken by a default policy.

Requests that belong to a PunchOut session are also served without an **X-Frame-Options** header. If you render PunchOut inside a procurement system's iframe, add your own `frame-ancestors` directive that names the procurement system to the **Content-Security-Policy** setting, and turn on the **Allow PunchOut in an iframe** setting. See [Allow PunchOut in an iframe](docId\:nFx7ajsIOfc8nR1HTN2w1).

:::hint{type="danger"}
**❗️ Warning**
Incorrectly implementing this setting could break your website.
:::