This feature will be available following the September 2026 release in your region. This task is for users with the OC Developer role.
You can manage your own security headers for each of your websites from the CMS admin. Security headers tell browsers how to handle website content securely and block common attacks.
To manage security headers:
- Go to More > Security Header Management.
- Select the Policy you need to edit:
-
Content Security Policy: This header is used to control where different resources, such as scripts, stylesheets, images, media, and fonts, can be loaded from.
- Cross Origin Opener Policy: This header manages optional settings for public site HTML responses. It isolates the browsing content from other windows and can help reduce cross-origin attacks. By default, this is set to Unset (default - header not sent).
-
Cross Origin Resource Policy: This header manages optional settings for public site responses, such as HTML, .AXD, and static JS, CSS, or image files. This policy restricts which origins can load these repsonses. It can help reduce cross-origin attacks. By default, this is set to Unset (default - header not sent).
-
Content Security Policy: This header is used to control where different resources, such as scripts, stylesheets, images, media, and fonts, can be loaded from.
- Save your changes as you move between policies.
These security headers apply per site; you will need to enact them on your public site, and any subsites you need as well.