# Content Security Policy

The theme writes no inline JavaScript. Its settings travel as JSON data blocks and all of its code comes from script files, so your site can be served with a strict [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP).

## Policy

This policy covers every feature of the theme except Mermaid

````http
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:
````

`style-src-attr 'unsafe-inline'` allows `style` attributes: the theme writes colors and image sizes given in your content as such, and Hugo colors highlighted code this way unless you [set `markup.highlight.noClasses=false`](configuration/branding/modules#change-syntax-highlighting). If none of this applies, you use no Mermaid and your [math output](shortcodes/math#output-of-the-formulae) is `mathml`, you can leave it out: Mermaid and the other math outputs write `style` attributes as well. Inline `<style>` elements stay forbidden; the theme writes none.

## What Needs More

- **Mermaid**: Mermaid writes its styles into inline `<style>` elements. Add `style-src-elem 'self' 'unsafe-inline'` - with `'self'` repeated, as it replaces `style-src` for all style elements.
- **Inlined SVGs**: an SVG shown with the [`inlinecontent` image effect](authoring/linking/imageeffects) brings its own `<style>` elements into the page, if it has any, and needs the same `style-src-elem`.
- **Your own inline JavaScript**: a `javascript:` URL as the `href` of a [button](shortcodes/button), [card](shortcodes/cards) or [topbar button](configuration/customization/topbar#button) is blocked. Give it an `action` instead and [handle that in a script file](shortcodes/button#button-with-own-action).

## Subresource Integrity

Set `enableSubresourceIntegrity=true` to have the theme add an [integrity hash](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) to each script and stylesheet it links, including the search index and the stylesheets of the OpenAPI shortcode. A browser then refuses a file that changed after the build.

{{< multiconfig file=hugo section=params >}}
enableSubresourceIntegrity = true
{{< /multiconfig >}}

> [!warning] Not for the file system
> A browser can not check an integrity hash for a page opened from the file system and refuses the file instead, which leaves the page without any script or style. Keep this off if your site must work that way.