Web Monetization Blog > Optimization > Fixing SSL issues with ads by implementing a Content Security Policy (CSP)

Fixing SSL issues with ads by implementing a Content Security Policy (CSP)

Rarely there are upstream ads being served that contain tracking pixels and other assets requested over http instead of https. Without a Content Security Policy on your website, these assets will load and the user will see a warning that their connection is insecure. Since this warning is pretty alarming to the average user, we highly recommend setting up a CSP.

Basic implementation

The simplest way to get a CSP rule on your website that will prevent these SSL errors is to place the following meta tag in the <head> of your pages.

<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content" />

Advanced implementation

More advanced users can implement CSP rules server side by writing a response header. The process of doing this varies service to service, but we’ve outlined some popular ones below;

AWS/CloudFront
Cloudflare
nginx
- Within server{}
  - add_header Content-Security-Policy "block-all-mixed-content";
Apache
- Within .htaccess or VirtualHost
  - Header set Content-Security-Policy "block-all-mixed-content"

Fixing SSL issues with ads by implementing a Content Security Policy (CSP)

Basic implementation

Advanced implementation

Categories

Recent Posts