kenshodigital/kirby-csp

Adds a strict CSP header to Kirby projects.

1.1.0 2025-12-09 16:21 UTC

Requires

• php: ^8.3 || ^8.4 || ^8.5
• getkirby/cms: ^4.8 || ^5.2
• getkirby/composer-installer: ^1.2

MIT

• Jens Scherbl

README

Adds a strict CSP header to Kirby projects.

General

Uses Kirby’s native nonce feature (used for the panel) to add a strict nonce-based content security policy header to all Kirby responses.

Further reading

• $kirby->nonce()

Usage

Installation

composer require kenshodigital/kirby-csp ^1.1

Setup

The plugin is not configurable and just follows the latest best practices.

script-src 'nonce-[…]' 'strict-dynamic' 'unsafe-inline' https:; object-src 'none'; base-uri 'none';

Development

However, scripts in your frontend are expected to include a nonce, like this.

<script nonce="<?= $kirby->nonce() ?>">
  …
</script>