# .htaccess file - CSP (Content Security Policy) **URL:** \ **Category:** Elements\ **Created:** [February 15, 2026, 2:39pm UTC](https://forums.realmacsoftware.com/t/htaccess-file-csp-content-security-policy/54379 "2026-02-15T14:39:29Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![PLM](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/plm/32/31094_2.png) [@PLM](https://forums.realmacsoftware.com/u/PLM)\ **Post date:** [February 15, 2026, 2:39pm UTC](https://forums.realmacsoftware.com/t/htaccess-file-csp-content-security-policy/54379/1 "2026-02-15T14:39:29Z")
There is a security headers code in the Elements manual - [.htaccess file | RapidWeaver Elements Docs](https://docs.realmacsoftware.com/elements-docs/elements/advanced/.htaccess-file#csp-content-security-policy) (scroll down). Is anyone using **CSP**? ”The main goal is to prevent attacks like cross-site scripting (XSS)”. There is also a link to test your site. My Elements site got a F. ![site](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/3X/6/c/6c3c1ee7157a57018aa79114d9ed9d7d19550d07.png) ---
**Author:** ![Fuellemann](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/fuellemann/32/22871_2.png) [@Fuellemann](https://forums.realmacsoftware.com/u/Fuellemann)\ **Post date:** [February 15, 2026, 3:06pm UTC](https://forums.realmacsoftware.com/t/htaccess-file-csp-content-security-policy/54379/2 "2026-02-15T15:06:39Z")
I am using CSP in the htaccess with an A rating: ![image](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/3X/b/0/b0b1534b68a97dbb43a613f45c533c63464a2925.png) @differentdan Have you had a chance to look at forms and the need to disable the referrer policy? @PLM Elements itself only has a very limited influence on this. How the htaccess is setup and how your hosting service allows changes and/or has security setup themselves is the defining point in this. ---
**Author:** ![PLM](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/plm/32/31094_2.png) [@PLM](https://forums.realmacsoftware.com/u/PLM)\ **Post date:** [February 15, 2026, 3:13pm UTC](https://forums.realmacsoftware.com/t/htaccess-file-csp-content-security-policy/54379/3 "2026-02-15T15:13:53Z")
I put the code in my .htaccess file and got an A. My server is using PHP 8.4, Apache 2.4 How to fix the last red Content-Security-Policy ? @tpbradley @Fuellemann we got different issues … my Referrer-Policy is okey. A mix of your code and the Elements manual code might fix the problem? ![site-A](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/3X/f/8/f8d6e0c5a7c8bc693721ccaa642f9c3839c4faa6.png) ---
**Author:** ![differentdan](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/differentdan/32/33530_2.png) [@differentdan](https://forums.realmacsoftware.com/u/differentdan)\ **Post date:** [February 15, 2026, 3:21pm UTC](https://forums.realmacsoftware.com/t/htaccess-file-csp-content-security-policy/54379/4 "2026-02-15T15:21:00Z")
> [@Fuellemann](#): > > @differentdan Have you had a chance to look at forms and the need to disable the referrer policy? I’ve got a lot going on, remind me where we talked about that again? ---
**Author:** ![Fuellemann](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/fuellemann/32/22871_2.png) [@Fuellemann](https://forums.realmacsoftware.com/u/Fuellemann)\ **Post date:** [February 15, 2026, 3:52pm UTC](https://forums.realmacsoftware.com/t/htaccess-file-csp-content-security-policy/54379/5 "2026-02-15T15:52:20Z")
Sorry, check my mail from December and it is definitely not any prio, just checking: On Mon, Dec 29, 2025 at 2:27 PM GMT, Jan Fuellemann [hallo@einfach-gute-seiten.de](mailto:hallo@einfach-gute-seiten.de) wrote: > In my htaccess I had disabled: > > # Referrer-Policy > > # Header set Referrer-Policy “no-referrer” > Oh strange, I will have to test that on my server as that’s a pretty common security setting so it should be able to be used without affecting the form. I’ll test it out and if I can reproduce then hopefully we can get that fixed. Thanks for letting me know! 🙂 ---
**Author:** ![differentdan](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/differentdan/32/33530_2.png) [@differentdan](https://forums.realmacsoftware.com/u/differentdan)\ **Post date:** [February 15, 2026, 4:02pm UTC](https://forums.realmacsoftware.com/t/htaccess-file-csp-content-security-policy/54379/6 "2026-02-15T16:02:50Z")
Thanks, will test it out on our new servers and see if I can replicate. Give me some time. 🙏