I got a solution by removing all the content security warnings by creating a module and adding the csp_whitelist.xml in the etc folder of the module.

Step 1: Create a module.

Step 2: Add csp_whitelist.xml in the etc folder of the module and copy-paste the below code in that file.

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <!--Google-->
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="googlecom" type="host">*.google.com</value>
                <value id="googlein" type="host">*.google.co.in</value>
                <value id="gtmanager" type="host">*.googletagmanager.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <!--Hotjar-->
                <value id="hotjar" type="host">*.hotjar.com</value>
                <!--Criteo-->
                <value id="criteo" type="host">*.criteo.com</value>
                <value id="criteonet" type="host">*.criteo.net</value>
                <!--Github-->
                <value id="github" type="host">*.github.io</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <!--Design-->
                <value id="googlefont" type="host">fonts.googleapis.com</value>
                <value id="maxcdn" type="host">*.bootstrapcdn.com</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="klarna-base" type="host">https://cdn.klarna.com</value>
                <!--Payments-->
                <value id="paypal" type="host">*.paypal.com</value>
                <!--Video-->
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
                <value id="youtube-img" type="host">https://s.ytimg.com</value>
                <!--Google-->
                <value id="googlecom" type="host">*.google.com</value>
                <value id="googlein" type="host">*.google.co.in</value>
                <!--Data-->
                <value id="data" type="host">data:</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <!--Google-->
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="gtmanager" type="host">*.googletagmanager.com</value>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <!--Payments-->
                <value id="paypal" type="host">*.paypal.com</value>
                <!--Double Click-->
                <value id="doubleclick" type="host">*.doubleclick.net</value>
            </values>
        </policy>
        <policy id="frame-src">
            <values>
                <!--Criteo-->
                <value id="criteo" type="host">*.criteo.com</value>
                <value id="criteonet" type="host">*.criteo.net</value>
                <!--Hotjar-->
                <value id="hotjar" type="host">*.hotjar.com</value>
                <!--Google-->
                <value id="googlecom" type="host">*.google.com</value>
                <value id="googlein" type="host">*.google.co.in</value>
                <!--Github-->
                <value id="github" type="host">*.github.io</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <!--Design-->
                <value id="googlefont" type="host">fonts.googleapis.com</value>
                <value id="maxcdn" type="host">*.bootstrapcdn.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

<?xml version="1.0"?>

<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">

<value id="cloudflare" type="host">*.cloudflare.com</value>

<value id="google-analytics" type="host">*.google-analytics.com</value>

<value id="googlecom" type="host">*.google.com</value>

<value id="googlein" type="host">*.google.co.in</value>

<value id="gtmanager" type="host">*.googletagmanager.com</value>

<value id="gstatic" type="host">*.gstatic.com</value>

<value id="hotjar" type="host">*.hotjar.com</value>

<value id="criteo" type="host">*.criteo.com</value>

<value id="criteonet" type="host">*.criteo.net</value>

<value id="github" type="host">*.github.io</value>

</values>

</policy>

<value id="cloudflare" type="host">*.cloudflare.com</value>

<value id="googlefont" type="host">fonts.googleapis.com</value>

<value id="maxcdn" type="host">*.bootstrapcdn.com</value>

</values>

</policy>

<value id="cloudflare" type="host">*.cloudflare.com</value>

<value id="klarna-base" type="host">https://cdn.klarna.com</value>

<value id="paypal" type="host">*.paypal.com</value>

<value id="vimeocdn" type="host">*.vimeocdn.com</value>

<value id="youtube-img" type="host">https://s.ytimg.com</value>

<value id="googlecom" type="host">*.google.com</value>

<value id="googlein" type="host">*.google.co.in</value>

</values>

</policy>

<value id="google-analytics" type="host">*.google-analytics.com</value>

<value id="gtmanager" type="host">*.googletagmanager.com</value>

<value id="cloudflare" type="host">*.cloudflare.com</value>

<value id="paypal" type="host">*.paypal.com</value>

<value id="doubleclick" type="host">*.doubleclick.net</value>

</values>

</policy>

<value id="criteo" type="host">*.criteo.com</value>

<value id="criteonet" type="host">*.criteo.net</value>

<value id="hotjar" type="host">*.hotjar.com</value>

<value id="googlecom" type="host">*.google.com</value>

<value id="googlein" type="host">*.google.co.in</value>

<value id="github" type="host">*.github.io</value>

</values>

</policy>

<value id="cloudflare" type="host">*.cloudflare.com</value>

<value id="googlefont" type="host">fonts.googleapis.com</value>

<value id="maxcdn" type="host">*.bootstrapcdn.com</value>

</values>

</policy>

</policies>

</csp_whitelist>

Clean the cache and check the site again. Probably all the Content security warnings will be removed by adding the above file in your module.

I think It will cover most of the domain, but if you face any other content security warnings then you can add the domain in the csp_whitelist.xml file.

Hope this article will help you to fix Magento 2.3.5 content security warnings.

Fill the below form if you have any Magento programming need.

Magento 2 convert registered customer order to guest order after placing order
create the event.xml on your module under the Vendor/Module/etc/event.xml and...
Magento 2 : How to add custom meta tag in product view page?
If you need a custom meta tag for a specific...
Magento 2: How to set load custom font as preload?
Generally, if you load font as preload, it will load...
Magento 2 – how to show including & excluding tax price on product option?
Step 1: First you need to add di.xml in the...
Magento 2 add the product description or custom attribute in order email
Override the vendor/magento/module-sales/view/frontend/templates/email/items/order/default.phtml file on your theme and add the...

Author Info

Hire A. Patel

Fill the form & Get Installation Support

Fix Magento 2.3.5 Content Security Warnings

Recent Articles

Author Info

Get a Free Quote

Connect With Us

Fill the form & Get Installation Support

Let us code, you focus on sales and marketing

Fix Magento 2.3.5 Content Security Warnings

Recent Articles

Author Info

Get a Free Quote

Connect With Us