Content-Security-Policy is the most powerful header on the list. It is also the only one that can break your site in production. That combination deserves honesty: AuditMerlin will flag a missing CSP, but we will never apply one to your site automatically. Even on the paid plan. Here is why, and how to do it right.

What CSP actually does

CSP is a whitelist. It tells the browser exactly which origins may supply scripts, styles, images, fonts and frames for your pages. If an attacker injects a script tag pointing at their server, the browser checks the list, finds no match, and refuses to run it. Cross-site scripting goes from full compromise to a blocked request in the console.

Why a wrong CSP is dangerous

Because the browser enforces it instantly and absolutely. A policy that forgets Google Fonts silently breaks your typography. One that forgets Stripe's domains breaks your checkout. Page builders like Elementor inline scripts and styles in ways strict policies block, which can take down the visual editing your whole site is built on. A copy-pasted "best practice" CSP on a real WordPress site usually breaks something within the hour, and what breaks first tends to be the thing that makes you money.

The safe rollout: report-only

CSP has a rehearsal mode built in:

Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-reports
  1. Observe. Ship the policy in report-only mode. Nothing is blocked; the browser just tells you what would have been.
  2. Widen. Add every legitimate origin the reports reveal: your CDN, fonts, analytics, payment scripts. Real sites need more entries than any template guesses.
  3. Enforce. When reports run quiet for a couple of weeks, switch the header to enforcing mode. Keep the reporting endpoint; it becomes your alarm for regressions.

Where AuditMerlin stands

Every other header finding in our reports has a one-click fix on Cloudflare because the risk of applying it is effectively zero. CSP gets guidance instead, because some fixes deserve a human decision. A security tool that silently pushes a CSP onto a live store is gambling with someone else's revenue. Run a free scan to see where your site stands, CSP included, with the standard behind every finding.