This bundle backports parts of the Content Security Policy (CSP) implementation of Contao 5.3 to Contao 4.13.
This bundle has no handling for inline scripts and styles. You need to add
'unsafe-inline'to your directives.
This bundle is just a backport. You can seamlessly upgrade to Contao 5.3 without touching your CSP configuration (you need to uninstall this bundle before upgrading).
Afterwards you can also remove the 'unsafe-inline' directive from your CSP configuration as contao 5.3 has support for handling inline scripts and styles for csp.
Install the bundle via composer or contao manager and update the database afterwards.
composer require heimrichhannot/contao-csp-bundleGo to the root page settings. There you find an option to enable CSP. If you enable it, you can configure the CSP directives.