Nitro Blog

Fixing SSL issues with ads by implementing a Content Security Policy (CSP)

Rarely there are upstream ads being served that contain tracking pixels and other assets requested over http instead of https. Without a Content Security Policy on your website, these assets will load and the user will see a warning that their connection is insecure. Since this warning is pretty alarming to the average user, we highly recommend setting up a CSP.

Basic implementation

The simplest way to get a CSP rule on your website that will prevent these SSL errors is to place the following meta tag in the <head> of your pages.

<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content" />

Advanced implementation

More advanced users can implement CSP rules server side by writing a response header. The process of doing this varies service to service, but we’ve outlined some popular ones below;

  • AWS/CloudFront
  • Cloudflare
  • nginx
    • Within server{}
      • add_header Content-Security-Policy "block-all-mixed-content";
  • Apache
    • Within .htaccess or VirtualHost
      • Header set Content-Security-Policy "block-all-mixed-content"