Content-Security-Policy (CSP) header examples for Salesforce Marketing Cloud CloudPages.

Content-Security-Policy header.ssjs

// SFMC source doc: https://help.salesforce.com/s/articleView?id=sf.mc_cp_cloud_pages_security_best_practices.htm&type=5
// CSP page for other examples: https://content-security-policy.com/

// standard example from doc
<script runat=server>
      Platform.Response.SetResponseHeader("Strict-Transport-Security","max-age=200");
      Platform.Response.SetResponseHeader("X-XSS-Protection","1; mode=block");
      Platform.Response.SetResponseHeader("X-Frame-Options","Deny");
      Platform.Response.SetResponseHeader("X-Content-Type-Options","nosniff");
      Platform.Response.SetResponseHeader("Referrer-Policy","strict-origin-when-cross-origin");
      Platform.Response.SetResponseHeader("Content-Security-Policy","default-src 'self'");
 </script>

// altered for multiple domains
<script runat=server>
      Platform.Response.SetResponseHeader("Strict-Transport-Security","max-age=200");
      Platform.Response.SetResponseHeader("X-XSS-Protection","1; mode=block");
      Platform.Response.SetResponseHeader("X-Frame-Options","Deny");
      Platform.Response.SetResponseHeader("X-Content-Type-Options","nosniff");
      Platform.Response.SetResponseHeader("Referrer-Policy","strict-origin-when-cross-origin");
      Platform.Response.SetResponseHeader("Content-Security-Policy","script-src 'self' https://[tenant].pub.sfmc-content.com https://*.domain.com; frame-ancestors 'none'; X-Permitted-Cross-Domain-Policies 'none'");
</script>