kenshodigital/kirby-csp

Adds a strict CSP header to Kirby projects.

2.0.1 2026-06-16 16:23 UTC

Requires

• php: ^8.5
• getkirby/cms: ^5.4
• getkirby/composer-installer: ^1.2

MIT

• kenshō digital

• security
• cms
• csp
• kirby

README

Adds a strict CSP header to Kirby projects.

General

Uses Kirby’s native nonce feature (used for the panel) to add a strict nonce-based content security policy header to HTML pages.

Further reading

• $kirby->nonce()

Usage

Installation

composer require kenshodigital/kirby-csp ^2.0

Setup

The plugin is not configurable and just follows the latest best practices.

script-src 'nonce-[…]' 'strict-dynamic'; object-src 'none'; base-uri 'none';

Development

However, scripts in your frontend are expected to include a nonce, like this.

<script nonce="<?= $kirby->nonce() ?>">
  …
</script>