Guide · Magento 2.4.7+

Storefront CSP whitelist without editing XML every time

On Magento 2.4.7+, the storefront Content-Security-Policy is stricter. Payment scripts, tag managers, and CDNs that used to load can start failing in the browser until their hosts are allowed. The long-term fix is still a change in git. Merchants still need a way to add a host from Admin between deploys, without wiping Magento’s own whitelist.

Where Magento’s whitelist already comes from

Storefront CSP is not a single setting. Magento already combines several sources, including:

• Module and theme csp_whitelist.xml
• Magento configuration
• Per-page rules from modules
• Checkout-specific sources when restrict mode is on

A module that overwrites that list, or that pastes a full policy into a text field, can drop Magento’s hosts. Checkout breaks, or a host you thought was still in XML is gone.

When XML is the right tool

If you control the code, add the host in the module or theme that owns the integration, commit it, and deploy. That is the correct long-term record. Risky keywords such as 'self' and 'unsafe-inline' belong there, or in Magento config, not in a merchant form.

When Admin is the right tool

If a merchant needs Stripe on the storefront tomorrow and the next code deploy is not until Thursday, Magento CSP restrict mode will block js.stripe.com until that host is allowed. In that situation you need a way to add the host for the right store views from Admin, without replacing Magento’s existing whitelist.

The right place for that change is a whitelist rule in Magento Admin. A module that does this well adds the new hosts to the storefront Content-Security-Policy rather than rewriting the policy from scratch.

CSP Manager

Paradise CSP Manager is an Admin panel CSP whitelist for Magento storefronts, plus a CSP Policy Inspector so you can see what is allowed. This guide is the background. Install steps.