CSP for Shopify
Shopify storefronts often rely on theme code, app embeds, analytics, checkout integrations, and external assets, so CSP needs careful allowlisting instead of a broad catch-all.
Where teams get stuck
- Theme code and vendor apps may both inject scripts.
- Third-party tags can require more than one directive.
- Broad allowlists become hard to audit over time.
Safer approach
List the exact vendors you truly need, review what each one loads after execution, and clean up old app domains regularly so the policy does not drift into https: everywhere.