Security & compliance
Configure your site's Content Security Policy and cookie-banner setting
The Security & compliance area covers your site's Content Security Policy (CSP) and the settings a theme can use for a cookie banner.
Open Security under Settings in Basker. The screen is titled "Security & Compliance" with the subtitle Manage your site's Content Security Policy and privacy banner settings for GDPR and CCPA compliance.
Content Security Policy
A Content Security Policy tells browsers which sources of scripts, images, fonts, and other resources can load on your site. It is a baseline defense against cross-site scripting and other injection attacks.
Basker offers three presets:
- Strict: most secure. May break third-party embeds and analytics.
- Moderate: same-origin scripts, external images over HTTPS and data URIs.
- Relaxed (default): most compatible, lowest security. Tighten to a stricter preset if you do not rely on third-party embeds.
A third-party script or embed sometimes needs more permissions than the preset grants. Add these as a JSON object in Custom Directives. For example:
{ "img-src": "'self' https://cdn.example.com" }Basker merges custom directives into the selected preset. It appends sources you add to that directive's existing sources. A custom directive can only widen a policy, never narrow it. To restrict what a preset allows, choose a stricter preset.
Trusted embed domains
Use Trusted Embed Domains when an HTML embed needs content from a specific HTTPS origin. For each origin, allow only the capabilities it needs: scripts, frames, images, media, or network connections. The generated CSP preview shows the resulting policy before you save.
When you add a trusted origin, it also lets the rich-text renderer keep the approved external content. This does not make the provider trustworthy. Review the source and keep the allowed capabilities narrow.
Cookie banner
The cookie banner setting stores whether the banner is turned on, and a link to your privacy policy. Themes that show a consent banner use these values.
Toggle Enable Cookie Banner. Enter the Privacy Policy URL. Confirm in preview that your active theme renders the banner as expected.
The setting does not block scripts
The banner does not automatically stop Google Analytics, Google Tag Manager, or other non-essential scripts. Your theme or tag manager must apply the visitor's consent choice. Test both accepting and declining the banner. Do not treat the setting alone as a compliance guarantee.
Saving changes
Click Save Changes at the bottom to apply both CSP and cookie banner updates.