---
title: "Security misconfiguration, headers and CSP · vuejs.school"
description: "Send security headers with nuxt-security, build a Content Security Policy with a nonce, roll it out in report-only mode first, and know what changes on a static site."
canonical_url: "https://vuejs.school/learn/security/security-headers-and-csp"
meta:
  "og:description": "Send security headers with nuxt-security, build a Content Security Policy with a nonce, roll it out in report-only mode first, and know what changes on a static site."
  "og:image": "https://vuejs.school/_og/d/a_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQ%2Cdescription_~U2VuZCBzZWN1cml0eSBoZWFkZXJzIHdpdGggbnV4dC1zZWN1cml0eSwgYnVpbGQgYSBDb250ZW50IFNlY3VyaXR5IFBvbGljeSB3aXRoIGEgbm9uY2UsIHJvbGwgaXQgb3V0IGluIHJlcG9ydC1vbmx5IG1vZGUgZmlyc3QsIGFuZCBrbm93IHdoYXQgY2hhbmdlcyBvbiBhIHN0YXRpYyBzaXRlLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNSBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zZWN1cml0eS1oZWFkZXJzLWFuZC1jc3Ai%2Cs_Rxi9kr6sFSqMIVLY.png"
  "og:image:alt": "Security misconfiguration, headers and CSP · vuejs.school"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Security misconfiguration, headers and CSP · vuejs.school"
  "twitter:image": "https://vuejs.school/_og/d/a_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQ%2Cdescription_~U2VuZCBzZWN1cml0eSBoZWFkZXJzIHdpdGggbnV4dC1zZWN1cml0eSwgYnVpbGQgYSBDb250ZW50IFNlY3VyaXR5IFBvbGljeSB3aXRoIGEgbm9uY2UsIHJvbGwgaXQgb3V0IGluIHJlcG9ydC1vbmx5IG1vZGUgZmlyc3QsIGFuZCBrbm93IHdoYXQgY2hhbmdlcyBvbiBhIHN0YXRpYyBzaXRlLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNSBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zZWN1cml0eS1oZWFkZXJzLWFuZC1jc3Ai%2Cs_Rxi9kr6sFSqMIVLY.png"
  "twitter:image:alt": "Security misconfiguration, headers and CSP · vuejs.school"
---

> Index of every page on this site: [llms.txt](https://vuejs.school/llms.txt)

# **Security misconfiguration, headers and CSP**

Send security headers with nuxt-security, build a Content Security Policy with a nonce, roll it out in report-only mode first, and know what changes on a static site.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://vuejs.school/#website","@type":"WebSite","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school/","publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/security-headers-and-csp#webpage","@type":"WebPage","description":"Send security headers with nuxt-security, build a Content Security Policy with a nonce, roll it out in report-only mode first, and know what changes on a static site.","name":"Security misconfiguration, headers and CSP","url":"https://vuejs.school/learn/security/security-headers-and-csp","breadcrumb":{"@id":"https://vuejs.school/learn/security/security-headers-and-csp#breadcrumb"},"isPartOf":{"@id":"https://vuejs.school/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://vuejs.school/learn/security/security-headers-and-csp"]}],"primaryImageOfPage":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/#identity","@type":"Organization","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school","logo":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/learn/security/security-headers-and-csp#article","description":"Send security headers with nuxt-security, build a Content Security Policy with a nonce, roll it out in report-only mode first, and know what changes on a static site.","headline":"Security misconfiguration, headers and CSP","inLanguage":"en","isAccessibleForFree":true,"thumbnailUrl":"https://vuejs.school/_og/d/a_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQ%2Cdescription_~U2VuZCBzZWN1cml0eSBoZWFkZXJzIHdpdGggbnV4dC1zZWN1cml0eSwgYnVpbGQgYSBDb250ZW50IFNlY3VyaXR5IFBvbGljeSB3aXRoIGEgbm9uY2UsIHJvbGwgaXQgb3V0IGluIHJlcG9ydC1vbmx5IG1vZGUgZmlyc3QsIGFuZCBrbm93IHdoYXQgY2hhbmdlcyBvbiBhIHN0YXRpYyBzaXRlLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNSBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zZWN1cml0eS1oZWFkZXJzLWFuZC1jc3Ai%2Cs_Rxi9kr6sFSqMIVLY.png","@type":["Article","TechArticle"],"articleSection":["Security"],"author":{"@id":"https://vuejs.school/#identity"},"image":{"@id":"https://vuejs.school/#/schema/image/1"},"isPartOf":{"@id":"https://vuejs.school/learn/security/security-headers-and-csp#webpage"},"keywords":["nuxt-security","Content-Security-Policy","nonce","Content-Security-Policy-Report-Only","frame-ancestors"],"mainEntityOfPage":{"@id":"https://vuejs.school/learn/security/security-headers-and-csp#webpage"},"publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/security-headers-and-csp#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Skill tree","item":"https://vuejs.school/track","position":1},{"@type":"ListItem","name":"Security & OWASP","item":"https://vuejs.school/track/security","position":2},{"@type":"ListItem","name":"Security misconfiguration, headers and CSP","position":3}]},{"@id":"https://vuejs.school/#logo","@type":"ImageObject","caption":"vuejs.school","contentUrl":"https://vuejs.school/apple-touch-icon.png","inLanguage":"en","url":"https://vuejs.school/apple-touch-icon.png"},{"@id":"https://vuejs.school/#/schema/image/1","@type":"ImageObject","contentUrl":"https://vuejs.school/_og/d/a_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQ%2Cdescription_~U2VuZCBzZWN1cml0eSBoZWFkZXJzIHdpdGggbnV4dC1zZWN1cml0eSwgYnVpbGQgYSBDb250ZW50IFNlY3VyaXR5IFBvbGljeSB3aXRoIGEgbm9uY2UsIHJvbGwgaXQgb3V0IGluIHJlcG9ydC1vbmx5IG1vZGUgZmlyc3QsIGFuZCBrbm93IHdoYXQgY2hhbmdlcyBvbiBhIHN0YXRpYyBzaXRlLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNSBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zZWN1cml0eS1oZWFkZXJzLWFuZC1jc3Ai%2Cs_Rxi9kr6sFSqMIVLY.png","inLanguage":"en","url":"https://vuejs.school/_og/d/a_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~U2VjdXJpdHkgbWlzY29uZmlndXJhdGlvbiwgaGVhZGVycyBhbmQgQ1NQ%2Cdescription_~U2VuZCBzZWN1cml0eSBoZWFkZXJzIHdpdGggbnV4dC1zZWN1cml0eSwgYnVpbGQgYSBDb250ZW50IFNlY3VyaXR5IFBvbGljeSB3aXRoIGEgbm9uY2UsIHJvbGwgaXQgb3V0IGluIHJlcG9ydC1vbmx5IG1vZGUgZmlyc3QsIGFuZCBrbm93IHdoYXQgY2hhbmdlcyBvbiBhIHN0YXRpYyBzaXRlLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNSBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9zZWN1cml0eS1oZWFkZXJzLWFuZC1jc3Ai%2Cs_Rxi9kr6sFSqMIVLY.png"}]}
```