On Craft 2.x, is it a known limitation that we must allow unsafe-inline for script-src in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it.

...Trying to get a high grade on Mozilla Observatory :)

1 Answer 1


I implemented this recently and what I ended up doing is return the content security headers using PHP. Depending on the request path (is it a CP URL or not?), we send CSP headers with unsafe-inline and unsafe-eval or not.

Of course, the CP is still unsecured, but what you can do is to specify a custom domain for the CP in your configuration (using the "baseCpUrl" key). Something like "admin.yourwebsite.com" that only certain users can access (using IP filtering for example).

It is still not a perfect solution, but we cannot do anything at the CP level unfortunately. I hope this will not be an issue anymore in Craft 3.

  • Does Craft 3 avoid this issue with unsafe-inline? Apr 9, 2018 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.