OM6.6: Admin > CMS > Content security policy

Note: CMS access is limited to customers on Pro and Enterprise Editions.

Content Security Policy (CSP) controls which external resources your portal is allowed to load — scripts, styles, images, fonts, and other content. It's a security feature that helps protect your portal and its users from malicious content.

Navigate to Admin > CMS > Content security policy

What CSP does

CSP defines a set of rules that tell browsers which sources of content are trusted. If a resource tries to load from a source not on the allowlist, the browser blocks it.

For example, if your portal uses Google Fonts, your CSP needs to include fonts.googleapis.com as a trusted source — otherwise browsers will block the fonts from loading.

When to update your CSP

You'll need to update your CSP when:

• You add external scripts (e.g. analytics, chat tools, tracking pixels)
• You reference external images or fonts not already on the allowlist
• You embed content from third-party platforms (e.g. an iframe)
• Something on your portal is being blocked by the browser

Configuring CSP

Note that this is an advanced setting suitable for web developers and folks that understand the technicalities of CSP. Please contact Brandkit Support if you are unsure.

1. Navigate to Admin > CMS > Content security policy
2. You will see several default CSP rules
3. Click the button + Add new CSP rule
4. Select a type of CSP rule (e.g. script-src)
5. Enter a value
6. Optionally enter a description
7. Save

Tips

• Incorrect CSP configuration can break your portal — test changes carefully.
• If you're seeing content blocked in the browser console, your CSP may need updating.
• Contact Brandkit support if you're unsure how to configure CSP for a specific integration.