Download the PHP package hotchand/module-csp-manager without Composer

Hotchand_CspManager

Magento 2 Content Security Policy (CSP) Whitelist Manager

A Magento 2 module that lets store administrators manage Content Security Policy whitelists, SHA-256 inline script hashes, and per-directive domain allowlists directly from the Magento admin panel without touching code or XML files.

The Problem

Magento 2.4+ enforces strict Content Security Policy (CSP) headers by default. Any third-party script, image, font, or API call that isn't explicitly whitelisted produces browser console errors like:

The native solution requires developers to create or edit csp_whitelist.xml files and redeploy static content every time a new domain needs to be allowed. This is slow and requires developer access.

The Solution

Hotchand_CspManager exposes a full CSP management UI under:

Add or remove domains for any CSP directive, paste inline script SHA-256 hashes from your browser console, and set your store's own domain for image whitelisting — all without touching a single file or running a deployment.

Features

• ✅ Admin UI for all major CSP directives (script-src, img-src, connect-src, style-src, font-src, frame-src, media-src)
• ✅ SHA-256 inline script hash management — paste hashes directly from browser console errors
• ✅ Explicit self-domain field for img-src to fix same-domain image blocking (common with Magebig and other themes)
• ✅ Comment support — lines starting with # are ignored, so you can annotate your whitelist
• ✅ Wildcard support — *.example.com syntax works natively
• ✅ Pre-populated defaults covering 50+ common third-party services out of the box
• ✅ Per-store-view configuration — different whitelists per store view or website
• ✅ Enable/disable toggle — disable the module without uninstalling
• ✅ Zero performance impact — policies are injected at request time via Magento's native PolicyCollectorInterface
• ✅ Compatible with Magento's existing CSP stack — merges with, not replaces, native policies

Pre-configured Third-Party Services

The module ships with defaults covering the most common services that trigger CSP violations:

Requirements

Installation

Composer (Recommended)

Manual Installation

1. Create the directory app/code/Hotchand/CspManager/
2. Copy all module files into that directory
3. Run the following commands from your Magento root:

Configuration

Navigate to Stores → Configuration → Hotchand → CSP Whitelist Manager.

General

Inline Script Hashes

Fixes Executing inline script violates the following Content Security Policy directive errors.

How to find the hash:

1. Open your browser's developer console
2. Look for a CSP error message ending in: ...a hash ('sha256-XXXXXXX='), or a nonce is required
3. Copy the full sha256-XXXXXXX= string
4. Paste it into the SHA-256 Inline Script Hashes field — one per line

Directives

Each directive has its own textarea. Format rules:

Image Sources — Store Domain Field

If your store's own images (wysiwyg, media) are being blocked despite 'self' being in the policy, enter your domain here:

This explicitly adds your domain as a host source in img-src, which resolves a known edge case in Magento 2.4.x where dynamically loaded images are not covered by 'self'.

Architecture

The module implements Magento\Csp\Api\PolicyCollectorInterface and registers itself into Magento's CompositePolicyCollector via di.xml.

Key class: Hotchand\CspManager\Model\CspPolicyCollector

• Runs on every frontend/adminhtml request
• Reads config from core_config_data (respects store scope)
• Merges custom domains into existing FetchPolicy objects rather than replacing them
• Safely parses sha256-XXXX= hash strings into the format FetchPolicy expects

Module Structure

Troubleshooting

Changes not taking effect

Flush the Magento cache after saving configuration:

If you are using Varnish or full-page cache, also purge that.

A domain I added is still being blocked

1. Make sure you added it to the correct directive. A script blocked under script-src won't be fixed by adding it to img-src.
2. Check that the domain format is correct — include the subdomain if the error URL has one.
3. If the error is about an inline script (not an external URL), it needs a SHA-256 hash, not a domain.

Inline script hash still blocked after adding it

Make sure you copied the full string including the sha256- prefix and the trailing =:

Same-domain images blocked (Magebig, wysiwyg)

Enter your store's domain (without https://) in the Image Sources → Store Domain field and flush cache.

Frequently Asked Questions

Does this replace Magento's native CSP system? No. It merges with it. Domains from csp_whitelist.xml files across all modules are preserved. This module adds on top.

Will this work on Magento Cloud / Adobe Commerce Cloud? Yes. The module uses Magento's standard config and DI systems with no file system writes at runtime.

Is there a performance impact? Minimal. The module reads from the Magento config cache on each request. No external HTTP calls are made.

Can I use this per store view? Yes. All fields support Default / Website / Store View scope.

What happens if I disable the module? Only the domains configured in this module's admin panel are removed from CSP headers. Native csp_whitelist.xml policies from Magento core and other modules continue to apply normally.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

1. Fork the repository
2. Create your feature branch: git checkout -b feature/my-feature
3. Commit your changes: git commit -m 'Add my feature'
4. Push to the branch: git push origin feature/my-feature
5. Open a Pull Request

License

MIT License

Author

Hotchand Sajnani Senior PHP / Magento Engineer ConnectResale LLC

Changelog

1.0.0 — 2026-01-01

• Initial release
• Admin UI for 7 CSP directives
• SHA-256 inline script hash management
• Explicit self-domain field for img-src
• 50+ pre-populated third-party domain defaults
• Per-store-view configuration support