PHPackages silverstripeltd/silverstripe-csp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. silverstripeltd/silverstripe-csp ActiveSilverstripe-vendormodule[Security](/categories/security) silverstripeltd/silverstripe-csp ================================ A module for CSP headers in Silverstripe. 3.0.0(8mo ago)911.3k↓32.4%3[3 issues](https://github.com/silverstripeltd/silverstripe-csp/issues)[2 PRs](https://github.com/silverstripeltd/silverstripe-csp/pulls)1BSD-3-ClausePHPPHP ^8.1CI passing Since Aug 3Pushed 6mo ago16 watchersCompare [ Source](https://github.com/silverstripeltd/silverstripe-csp)[ Packagist](https://packagist.org/packages/silverstripeltd/silverstripe-csp)[ RSS](/packages/silverstripeltd-silverstripe-csp/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (7)Dependencies (4)Versions (17)Used By (1) Silverstripe Content Security Policy ==================================== [](#silverstripe-content-security-policy) Make your site *like* super secure with CSP headers and SRI tags on your scripts. This module is not currently supported, it will frequently change and break APIs. Requirements ------------ [](#requirements) - SilverStripe ^5 (4.11+ available in previous tags) Installation ------------ [](#installation) First you install it, then you configure it. Like lego! ``` composer require silverstripeltd/silverstripe-csp ``` Documentation ------------- [](#documentation) First you're going to want to create a **Policy** you'll likely want to extend the **Basic** policy as a good starting ground. This will look something like: ``` class ContentSecurityPolicy extends Basic { public function configure(): void { parent::configure(); } } ``` You can then start adding in **fragments**. These are small pieces of code that resemble a CSP for a service. For example YouTube's is: ``` class YouTube implements Fragment { public static function addTo(Policy $policy): void { $policy ->addDirective(Directive::SCRIPT, [ 'www.youtube.com', 's.ytimg.com', ]) ->addDirective(Directive::FRAME, "*.youtube.com"); } } ``` If you need to add a new fragment or update an existing one please make a pull request to the repo. You've either found a potential issue for all our projects using this, or you're adding a new service which other projects can benefit from Adding fragments to your policy looks like this (in configure func from above): ``` public function configure(): void { parent::configure(); $this->addFragments([YouTube::class]); } ``` *Usually you'll define `private const FRAGMENTS = []` and add them in there so it's clear at the beginning what fragments you're adding.* To set the **report to** url, we usually use an env var named `CSP_REPORT_TO`. The expiry time can also be set using `CSP_REPORT_TO_TTL` this tells the browser how long it should remember the url for. You can also call `$this->reportTo()` in your policies configure func if required (perhaps you want the report URI based on the policy applied). Reporting can be sent to multiple urls if required, `CSP_REPORT_TO` supports CSV, or the directive can be used with an array. To add the policy to the list of applied policies you'll want to add some yaml config: ``` Silverstripe\CSP\CSPMiddleware: policies: - 'Silverstripe\CSP\Policies\CMS' - 'App\ContentSecurityPolicy' ``` In the above we've added it to be checked after the CMS policy that is included by default. To make the policy **report only** you can either add the env var `CSP_REPORT_ONLY='enabled'` or code it in your policy, for example: ``` public function configure(): void { parent::configure(); if (Director::isDev()) { $this->reportOnly(); } } ``` Google Tag Manager / Adservices whitelist ----------------------------------------- [](#google-tag-manager--adservices-whitelist) Google uses localised regional domains for visitors for image tracker loading, which can pile up report violations with `google.com|.co.nz|.com.au` etc in your reporting tool. To resolve this and rather than specifying all of Google's listed support domains (see [https://www.google.com/supported\_domains](https://www.google.com/supported_domains)) A white list config can be set to the GTM fragment to whitelist all `https:` URLs on the `img-src` directive, for example: ``` Silverstripe\CSP\Fragments\GoogleTagManager: whitelist_google_regional_domains: true ``` > See also ImagesOverHTTPs::class for more basic cover of https images. SRI --- [](#sri) We also support SRI in this module, you can enable this via yaml: ``` Silverstripe\CSP\CSPMiddleware: sri_enabled: true ``` This will add SRI hashes to resources added through the requirements. It will not do this to the resources added through `insertHeadTags`. It will also not create this for files that are dynamically created (e.g. tinymce files) We won't add SRI hashes for external resources, if this is required then you should be adding them in yourself after being provided them by the external resource (we don't do this as we can't control when or how often those are recalculated) **dev/build** will clear the SRI records (we keep these to ensure we don't generate them per request). This has been added through the `DevBuildExtension` Todo list: ---------- [](#todo-list) - Add the ability to hash inline scripts (this would sit in `CSPBackend`) - Add Google analytics and tag manager (this will happen shortly) - Add unit tests Maintainers ----------- [](#maintainers) - Adrian Bugtracker ---------- [](#bugtracker) Bugs are tracked in the issues section of this repository. Before submitting an issue please read over existing issues to ensure yours is unique. If the issue does look like a new bug: - Create a new issue - Describe the steps required to reproduce your issue, and the expected outcome. Unit tests, screenshots and screencasts can help here. - Describe your environment as detailed as possible: SilverStripe version, Browser, PHP version, Operating System, any installed SilverStripe modules. Please report security issues to the module maintainers directly. Please don't file security issues in the bugtracker. Development and contribution ---------------------------- [](#development-and-contribution) If you would like to make contributions to the module please ensure you raise a pull request and discuss with the module maintainers. License ------- [](#license) See [License](license.md) ### Health Score 48 — FairBetter than 95% of packages Maintenance58 Moderate activity, may be stable Popularity34 Limited adoption so far Community22 Small or concentrated contributor base Maturity68 Established project with proven stability Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~145 days Recently: every ~105 days Total 11 Last Release 251d ago Major Versions 0.1.2 → 1.0.02021-11-16 1.0.0 → 2.0.02023-02-16 1.x-dev → 3.0.02025-09-09 ### Community Maintainers ![](https://www.gravatar.com/avatar/c908aac2ff1c0c0763a662df79bd03e53edcb12fb3115a7304f7e6892e0751ec?d=identicon)[silverstripe-serviceaccount-ssltd](/maintainers/silverstripe-serviceaccount-ssltd) --- Top Contributors [![jareddreyerss](https://avatars.githubusercontent.com/u/56658401?v=4)](https://github.com/jareddreyerss "jareddreyerss (8 commits)")[![edwilde](https://avatars.githubusercontent.com/u/415374?v=4)](https://github.com/edwilde "edwilde (8 commits)")[![satrun77](https://avatars.githubusercontent.com/u/166450?v=4)](https://github.com/satrun77 "satrun77 (4 commits)")[![scott1702](https://avatars.githubusercontent.com/u/10215604?v=4)](https://github.com/scott1702 "scott1702 (3 commits)")[![adrhumphreys](https://avatars.githubusercontent.com/u/10803137?v=4)](https://github.com/adrhumphreys "adrhumphreys (1 commits)")[![Jianbinzhu](https://avatars.githubusercontent.com/u/11606683?v=4)](https://github.com/Jianbinzhu "Jianbinzhu (1 commits)")[![chrispenny](https://avatars.githubusercontent.com/u/505788?v=4)](https://github.com/chrispenny "chrispenny (1 commits)") --- Tags silverstripecmscspcontent-security-policy ### Code Quality Code StylePHP\_CodeSniffer ### Embed Badge ![Health badge](/badges/silverstripeltd-silverstripe-csp/health.svg) ``` [![Health](https://phpackages.com/badges/silverstripeltd-silverstripe-csp/health.svg)](https://phpackages.com/packages/silverstripeltd-silverstripe-csp) ``` ### Alternatives [spatie/laravel-csp Add CSP headers to the responses of a Laravel app 8569.6M19](/packages/spatie-laravel-csp)[aidantwoods/secureheaders A PHP class aiming to make the use of browser security features more accessible. 433689.3k2](/packages/aidantwoods-secureheaders)[born05/craft-csp Content Security Policy (or CSP) generator using nonces. 1110.2k](/packages/born05-craft-csp)[feejin/silverstripe-securitytemplates Custom security templates to mirror CMS 128.1k1](/packages/feejin-silverstripe-securitytemplates) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)