Security & compliance
Configure your site's Content Security Policy and cookie-banner setting
The Security & compliance area covers your site's Content Security Policy (CSP) and the settings a theme can use for a cookie banner.
Open Security under Settings in Basker. The screen is titled "Security & Compliance" with the subtitle Manage your site's Content Security Policy and privacy banner settings for GDPR and CCPA compliance.
Content Security Policy
A Content Security Policy tells browsers which sources of scripts, images, fonts, and other resources are allowed to load on your site. It's a baseline defence against cross-site scripting and other injection attacks.
Basker offers three presets:
- Strict: most secure. May break third-party embeds and analytics.
- Moderate: same-origin scripts, external images over HTTPS and data URIs.
- Relaxed (default): most compatible, lowest security. Tighten to a stricter preset if you don't rely on third-party embeds.
If a third-party script or embed needs more permissions than the preset grants, add them in Custom Directives as a JSON object. For example:
{ "img-src": "'self' https://cdn.example.com" }Custom directives are merged into the selected preset. A custom value replaces the matching preset directive.
Trusted embed domains
Use Trusted Embed Domains when an HTML embed needs content from a specific HTTPS origin. For each origin, allow only the capabilities it needs: scripts, frames, images, media, or network connections. The generated CSP preview shows the resulting policy before you save.
Adding a trusted origin also lets the rich-text HTML renderer retain the approved external content. It does not make the provider trustworthy; review the source and keep the allowed capabilities narrow.
Cookie banner
The cookie-banner settings store an enabled choice and a link to your privacy policy for themes that implement a consent banner.
Toggle Enable Cookie Banner and enter the Privacy Policy URL. Confirm in preview that your active theme renders the banner as expected.
The setting does not block scripts
Enabling the banner does not automatically stop Google Analytics, Google Tag Manager, or other non-essential scripts. Your theme or tag manager must apply the visitor's consent choice. Test accepting and declining rather than treating the setting alone as a compliance guarantee.
Saving changes
Click Save Changes at the bottom to apply both CSP and cookie banner updates.