PHPackages silverstripeltd/silverstripe-csp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. silverstripeltd/silverstripe-csp ActiveSilverstripe-vendormodule[Security](/categories/security) silverstripeltd/silverstripe-csp ================================ A module for CSP headers in Silverstripe. 3.0.0(9mo ago)913.9k↑15.2%3[3 issues](https://github.com/silverstripeltd/silverstripe-csp/issues)[2 PRs](https://github.com/silverstripeltd/silverstripe-csp/pulls)1BSD-3-ClausePHPPHP ^8.1CI passing Since Aug 3Pushed 7mo ago16 watchersCompare [ Source](https://github.com/silverstripeltd/silverstripe-csp)[ Packagist](https://packagist.org/packages/silverstripeltd/silverstripe-csp)[ RSS](/packages/silverstripeltd-silverstripe-csp/feed)WikiDiscussions main Synced 2d ago READMEChangelog (7)Dependencies (4)Versions (17)Used By (1) Silverstripe Content Security Policy ==================================== [](#silverstripe-content-security-policy) Make your site *like* super secure with CSP headers and SRI tags on your scripts. This module is not currently supported, it will frequently change and break APIs. Requirements ------------ [](#requirements) - SilverStripe ^5 (4.11+ available in previous tags) Installation ------------ [](#installation) First you install it, then you configure it. Like lego! ``` composer require silverstripeltd/silverstripe-csp ``` Documentation ------------- [](#documentation) First you're going to want to create a **Policy** you'll likely want to extend the **Basic** policy as a good starting ground. This will look something like: ``` class ContentSecurityPolicy extends Basic { public function configure(): void { parent::configure(); } } ``` You can then start adding in **fragments**. These are small pieces of code that resemble a CSP for a service. For example YouTube's is: ``` class YouTube implements Fragment { public static function addTo(Policy $policy): void { $policy ->addDirective(Directive::SCRIPT, [ 'www.youtube.com', 's.ytimg.com', ]) ->addDirective(Directive::FRAME, "*.youtube.com"); } } ``` If you need to add a new fragment or update an existing one please make a pull request to the repo. You've either found a potential issue for all our projects using this, or you're adding a new service which other projects can benefit from Adding fragments to your policy looks like this (in configure func from above): ``` public function configure(): void { parent::configure(); $this->addFragments([YouTube::class]); } ``` *Usually you'll define `private const FRAGMENTS = []` and add them in there so it's clear at the beginning what fragments you're adding.* To set the **report to** url, we usually use an env var named `CSP_REPORT_TO`. The expiry time can also be set using `CSP_REPORT_TO_TTL` this tells the browser how long it should remember the url for. You can also call `$this->reportTo()` in your policies configure func if required (perhaps you want the report URI based on the policy applied). Reporting can be sent to multiple urls if required, `CSP_REPORT_TO` supports CSV, or the directive can be used with an array. To add the policy to the list of applied policies you'll want to add some yaml config: ``` Silverstripe\CSP\CSPMiddleware: policies: - 'Silverstripe\CSP\Policies\CMS' - 'App\ContentSecurityPolicy' ``` In the above we've added it to be checked after the CMS policy that is included by default. To make the policy **report only** you can either add the env var `CSP_REPORT_ONLY='enabled'` or code it in your policy, for example: ``` public function configure(): void { parent::configure(); if (Director::isDev()) { $this->reportOnly(); } } ``` Google Tag Manager / Adservices whitelist ----------------------------------------- [](#google-tag-manager--adservices-whitelist) Google uses localised regional domains for visitors for image tracker loading, which can pile up report violations with `google.com|.co.nz|.com.au` etc in your reporting tool. To resolve this and rather than specifying all of Google's listed support domains (see [https://www.google.com/supported\_domains](https://www.google.com/supported_domains)) A white list config can be set to the GTM fragment to whitelist all `https:` URLs on the `img-src` directive, for example: ``` Silverstripe\CSP\Fragments\GoogleTagManager: whitelist_google_regional_domains: true ``` > See also ImagesOverHTTPs::class for more basic cover of https images. SRI --- [](#sri) We also support SRI in this module, you can enable this via yaml: ``` Silverstripe\CSP\CSPMiddleware: sri_enabled: true ``` This will add SRI hashes to resources added through the requirements. It will not do this to the resources added through `insertHeadTags`. It will also not create this for files that are dynamically created (e.g. tinymce files) We won't add SRI hashes for external resources, if this is required then you should be adding them in yourself after being provided them by the external resource (we don't do this as we can't control when or how often those are recalculated) **dev/build** will clear the SRI records (we keep these to ensure we don't generate them per request). This has been added through the `DevBuildExtension` Todo list: ---------- [](#todo-list) - Add the ability to hash inline scripts (this would sit in `CSPBackend`) - Add Google analytics and tag manager (this will happen shortly) - Add unit tests Maintainers ----------- [](#maintainers) - Adrian Bugtracker ---------- [](#bugtracker) Bugs are tracked in the issues section of this repository. Before submitting an issue please read over existing issues to ensure yours is unique. If the issue does look like a new bug: - Create a new issue - Describe the steps required to reproduce your issue, and the expected outcome. Unit tests, screenshots and screencasts can help here. - Describe your environment as detailed as possible: SilverStripe version, Browser, PHP version, Operating System, any installed SilverStripe modules. Please report security issues to the module maintainers directly. Please don't file security issues in the bugtracker. Development and contribution ---------------------------- [](#development-and-contribution) If you would like to make contributions to the module please ensure you raise a pull request and discuss with the module maintainers. License ------- [](#license) See [License](license.md) ### Health Score 48 — FairBetter than 93% of packages Maintenance53 Moderate activity, may be stable Popularity34 Limited adoption so far Community23 Small or concentrated contributor base Maturity69 Established project with proven stability Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~145 days Recently: every ~105 days Total 11 Last Release 297d ago Major Versions 0.1.2 → 1.0.02021-11-16 1.0.0 → 2.0.02023-02-16 1.x-dev → 3.0.02025-09-09 ### Community Maintainers ![](https://www.gravatar.com/avatar/c908aac2ff1c0c0763a662df79bd03e53edcb12fb3115a7304f7e6892e0751ec?d=identicon)[silverstripe-serviceaccount-ssltd](/maintainers/silverstripe-serviceaccount-ssltd) --- Top Contributors [![jareddreyerss](https://avatars.githubusercontent.com/u/56658401?v=4)](https://github.com/jareddreyerss "jareddreyerss (8 commits)")[![edwilde](https://avatars.githubusercontent.com/u/415374?v=4)](https://github.com/edwilde "edwilde (8 commits)")[![satrun77](https://avatars.githubusercontent.com/u/166450?v=4)](https://github.com/satrun77 "satrun77 (4 commits)")[![scott1702](https://avatars.githubusercontent.com/u/10215604?v=4)](https://github.com/scott1702 "scott1702 (3 commits)")[![adrhumphreys](https://avatars.githubusercontent.com/u/10803137?v=4)](https://github.com/adrhumphreys "adrhumphreys (1 commits)")[![Jianbinzhu](https://avatars.githubusercontent.com/u/11606683?v=4)](https://github.com/Jianbinzhu "Jianbinzhu (1 commits)")[![chrispenny](https://avatars.githubusercontent.com/u/505788?v=4)](https://github.com/chrispenny "chrispenny (1 commits)") --- Tags silverstripecmscspcontent-security-policy ### Code Quality Code StylePHP\_CodeSniffer ### Embed Badge ![Health badge](/badges/silverstripeltd-silverstripe-csp/health.svg) ``` [![Health](https://phpackages.com/badges/silverstripeltd-silverstripe-csp/health.svg)](https://phpackages.com/packages/silverstripeltd-silverstripe-csp) ``` ### Alternatives [silverstripe/cms The SilverStripe Content Management System 5253.6M1.4k](/packages/silverstripe-cms)[silverstripe/userforms UserForms enables CMS users to create dynamic forms via a drag and drop interface and without getting involved in any PHP code 1371.1M85](/packages/silverstripe-userforms)[symbiote/silverstripe-advancedworkflow Adds configurable workflow support to the CMS, with a GUI for creating custom workflow definitions. 46302.4k9](/packages/symbiote-silverstripe-advancedworkflow)[born05/craft-csp Content Security Policy (or CSP) generator using nonces. 1110.4k](/packages/born05-craft-csp)[sunnysideup/ecommerce Silverstripe E-commerce Application 247.3k84](/packages/sunnysideup-ecommerce)[axllent/silverstripe-cms-tweaks Several CMS usability improvements 1726.4k1](/packages/axllent-silverstripe-cms-tweaks) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)