{"id":179640,"date":"2026-01-08T14:16:36","date_gmt":"2026-01-08T05:16:36","guid":{"rendered":"https:\/\/support.questetra.com\/?p=179640"},"modified":"2026-07-16T09:43:37","modified_gmt":"2026-07-16T00:43:37","slug":"csp","status":"publish","type":"post","link":"https:\/\/support.questetra.com\/en\/system-settings\/csp\/","title":{"rendered":"System Settings – CSP"},"content":{"rendered":"\n
<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

Overview<\/strong><\/h4>\n\n\n\n

Displays configuration options for the Content Security Policy-based restrictions. Allows system administrators to restrict behavior defined at the app level, contributing to improved security.<\/p>\n\n\n\n

\n
CSP Settings<\/strong><\/summary>
\n\n

<\/p>\n\n\n

\n
    \n
  • check_box<\/span> Enable CSP enforcement<\/li> \n <\/ul>\n <\/div>\n\n<\/div><\/details><\/div>\n<\/div>\n\n\n\n
    \n
    CSP Allowlist<\/strong><\/summary>
    \n\n

    <\/p>\n\n\n

    add<\/span> Add Entry\n
      \n
    • arrow_drop_down<\/span> Directive*\n
        \n
      • Script file requests (script-src)<\/li>\n
      • Data communications (connect-src)<\/li>\n <\/ul>\n <\/li>\n
      • mode_edit_outline<\/span> Source*<\/li>\n
      • mode_edit_outline<\/span> Comment<\/li>\n
      • check_box<\/span> Enabled<\/li>\n <\/ul>\n <\/div>\n
        Script file requests\n
          \n
        • format_list_bulleted<\/span>\n
            \n
          • search<\/span> Source \/ Comment \/ Status \/ Updated by \/ Updated<\/li>\n <\/ul>\n <\/li>\n <\/ul>\n <\/div>\n
            Data communications\n
              \n
            • format_list_bulleted<\/span>\n
                \n
              • search<\/span> Source \/ Comment \/ Status \/ Updated by \/ Updated<\/li>\n <\/ul>\n <\/li>\n <\/ul>\n <\/div>\n\n<\/div><\/details><\/div>\n<\/div>\n\n\n\n
                \n
                CSP Reports<\/strong><\/summary>
                \n\n

                <\/p>\n\n\n

                \n
                  \n
                • move_selection_right<\/span> Today \/ Yesterday \/ This Month \/ Last Month<\/li>\n
                • Date range<\/li>\n
                • format_list_bulleted<\/span>\n
                    \n
                  • Directive \/ Violation Host \/ Count<\/li>\n <\/ul>\n <\/li>\n
                  • \n cloud_download<\/span> Download CSV\n <\/li>\n <\/ul>\n <\/div>\n\n<\/div><\/details><\/div>\n<\/div>\n\n\n\n

                    Capture<\/h3>\n\n\n\n
                    \"\"<\/figure>\n\n\n\n
                    \"\"<\/figure>\n\n\n\n
                    \"\"<\/figure>\n\n\n\n

                    Notes<\/h3>\n\n\n\n
                      \n
                    • Content Security Policy (CSP) restrictions can be enabled and an allow list can be set<\/li>\n\n\n\n
                    • Markdown\/HTML\/JavaScript written in the [Description] field of Data Items are the subjects<\/li>\n\n\n\n
                    • System administrators can restrict app-defined behavior, improving security<\/li>\n\n\n\n
                    • This is a platform-wide common setting; it cannot be configured on a per-app basis<\/li>\n\n\n\n
                    • You can view a Content Security Policy (CSP) violation report\n
                        \n
                      • [CSP report] records a list of external site accesses that exclude access to hosts allowed by CSP settings<\/li>\n\n\n\n
                      • The report is recorded regardless of whether CSP restrictions are enabled or disabled\n
                          \n
                        • Enabled: Access is blocked and recorded in the report<\/li>\n\n\n\n
                        • Disabled: No blocking occurs, only recorded in the report<\/li>\n\n\n\n
                        • The Disposition<\/code> field in the report CSV identifies whether the restriction was enabled or disabled<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                        • It is not guaranteed that all accesses will be recorded\n
                            \n
                          • If there are many accesses in a short period of time, some accesses will not be recorded<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                          • For newly created workflow platforms, CSP restrictions are enabled by default\n
                              \n
                            • On workflow platforms newly built from Version 17.2 onward, loading scripts from external sites and making AJAX requests to external destinations are disabled by default<\/li>\n\n\n\n
                            • For existing workflow platforms upgraded from Version 17.1 to 17.2, CSP restrictions remain disabled (Existing behavior is unchanged unless CSP is explicitly enabled)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                              Displays configuration options for the Content Security Policy-based restrictions. Allows system administrators to restrict behavior defined at the app level, contributing to improved security.<\/p>\n","protected":false},"author":30,"featured_media":179653,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","_uag_custom_page_level_css":"","advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_seo_schema_type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"{title}\n\n{excerpt}\n\n{url}","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false,"jetpack_post_was_ever_published":false},"categories":[2970],"tags":[],"faq_section":[],"class_list":["post-179640","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-system-settings"],"jetpack_publicize_connections":[],"uagb_featured_image_src":{"full":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=1200%2C675&ssl=1",1200,675,false],"thumbnail":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=440%2C440&ssl=1",440,440,true],"medium":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=560%2C315&ssl=1",560,315,true],"medium_large":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=768%2C432&ssl=1",768,432,true],"large":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=1024%2C576&ssl=1",1024,576,true],"1536x1536":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=1200%2C675&ssl=1",1200,675,true],"2048x2048":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=1200%2C675&ssl=1",1200,675,true],"newspack-article-block-landscape-large":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=1200%2C675&ssl=1",1200,675,true],"newspack-article-block-portrait-large":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=900%2C675&ssl=1",900,675,true],"newspack-article-block-square-large":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=1200%2C675&ssl=1",1200,675,true],"newspack-article-block-landscape-medium":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=800%2C600&ssl=1",800,600,true],"newspack-article-block-portrait-medium":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=600%2C675&ssl=1",600,675,true],"newspack-article-block-square-medium":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=800%2C675&ssl=1",800,675,true],"newspack-article-block-landscape-intermediate":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=600%2C450&ssl=1",600,450,true],"newspack-article-block-portrait-intermediate":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=450%2C600&ssl=1",450,600,true],"newspack-article-block-square-intermediate":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=600%2C600&ssl=1",600,600,true],"newspack-article-block-landscape-small":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=400%2C300&ssl=1",400,300,true],"newspack-article-block-portrait-small":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=300%2C400&ssl=1",300,400,true],"newspack-article-block-square-small":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=400%2C400&ssl=1",400,400,true],"newspack-article-block-landscape-tiny":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=200%2C150&ssl=1",200,150,true],"newspack-article-block-portrait-tiny":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=150%2C200&ssl=1",150,200,true],"newspack-article-block-square-tiny":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?resize=200%2C200&ssl=1",200,200,true],"newspack-article-block-uncropped":["https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=1200%2C675&ssl=1",1200,675,true]},"uagb_author_info":{"display_name":"Peter Glover","author_link":"https:\/\/support.questetra.com\/en\/author\/petergloverquestetra\/"},"uagb_comment_info":0,"uagb_excerpt":"Displays configuration options for the Content Security Policy-based restrictions. Allows system administrators to restrict behavior defined at the app level, contributing to improved security.","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/s9DiIh-csp","jetpack-related-posts":[{"id":82606,"url":"https:\/\/support.questetra.com\/en\/system-settings\/cors\/","url_meta":{"origin":179640,"position":0},"title":"System Settings – CORS","author":"Peter Glover","date":"2020-03-05","format":false,"excerpt":"Cross-Origin Resource Sharing (CORS) allows you to control and restrict the origins from which communication to your workflow system is received.","rel":"","context":"In "System Settings"","block_context":{"text":"System Settings","link":"https:\/\/support.questetra.com\/en\/category\/system-settings\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-CORS.png?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-CORS.png?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-CORS.png?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-CORS.png?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-CORS.png?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":125684,"url":"https:\/\/support.questetra.com\/en\/system-settings\/http-destination-filtering\/","url_meta":{"origin":179640,"position":1},"title":"System Settings – HTTP Destination Filtering","author":"Hirotaka NISHI","date":"2022-08-08","format":false,"excerpt":"Restrict the targets of HTTP communication from the Workflow App. Registering hostnames that allow communication as a white list will prohibit communication to other hosts.","rel":"","context":"In "System Settings"","block_context":{"text":"System Settings","link":"https:\/\/support.questetra.com\/en\/category\/system-settings\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2022\/07\/system-settings-http-destination-filtering-fi-en.png?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2022\/07\/system-settings-http-destination-filtering-fi-en.png?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2022\/07\/system-settings-http-destination-filtering-fi-en.png?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2022\/07\/system-settings-http-destination-filtering-fi-en.png?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2022\/07\/system-settings-http-destination-filtering-fi-en.png?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":76212,"url":"https:\/\/support.questetra.com\/en\/bpmn-icons\/message-start-event-form\/","url_meta":{"origin":179640,"position":2},"title":"Message Start Event (form)","author":"Hirotaka NISHI","date":"2024-09-02","format":false,"excerpt":"Issues a Web form (its URL) for awaiting entry. Starts a new process automatically by receiving entry. The form can be embedded on any website using \"iframe\" HTML tag.","rel":"","context":"In "BPMN Icons"","block_context":{"text":"BPMN Icons","link":"https:\/\/support.questetra.com\/en\/category\/bpmn-icons\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-form-1200x675.png?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-form-1200x675.png?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-form-1200x675.png?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-form-1200x675.png?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-form-1200x675.png?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":68598,"url":"https:\/\/support.questetra.com\/en\/versions\/version-1151\/","url_meta":{"origin":179640,"position":3},"title":"v11.5.1 2017-12-25 Support for TLS 1.0 encryption Discontinued","author":"Hirotaka NISHI","date":"2017-12-18","format":false,"excerpt":"Release Overview Date Release Mon. Dec. 25th, 2017 Changes to be Noted Disable TLS 1.0 encryption (Paid Edition) It is already discontinued in the Free version. If verification is necessary, please conduct it in the Free Edition environment. Internet Explorer 9\/10, you will not be able to use Questetra Internet\u2026","rel":"","context":"In "Version Info"","block_context":{"text":"Version Info","link":"https:\/\/support.questetra.com\/en\/category\/versions\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2017\/12\/version-1151-fi-en-1.png?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2017\/12\/version-1151-fi-en-1.png?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2017\/12\/version-1151-fi-en-1.png?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2017\/12\/version-1151-fi-en-1.png?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2017\/12\/version-1151-fi-en-1.png?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":78762,"url":"https:\/\/support.questetra.com\/en\/bpmn-icons\/message-start-event-webhook\/","url_meta":{"origin":179640,"position":4},"title":"Message Start Event (Webhook)","author":"Hirotaka NISHI","date":"2019-10-01","format":false,"excerpt":"Issues a URL that awaits Webhook (HTTP request) in a specified method. Starts a new Process automatically when a Webhook is received. Capable of storing the received request body in a String-type Data Item. Also possible to return an HTTP response with Business Data inserted.","rel":"","context":"In "BPMN Icons"","block_context":{"text":"BPMN Icons","link":"https:\/\/support.questetra.com\/en\/category\/bpmn-icons\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-webhook-1200x675.png?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-webhook-1200x675.png?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-webhook-1200x675.png?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-webhook-1200x675.png?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2019\/10\/bpmn-icon-message-start-event-webhook-1200x675.png?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":82471,"url":"https:\/\/support.questetra.com\/en\/system-settings\/ip-address-filtering\/","url_meta":{"origin":179640,"position":5},"title":"System Settings – IP Address Filtering","author":"Peter Glover","date":"2020-03-05","format":false,"excerpt":"Allows access to URLs from external clients to be restricted to specific IP addresses.","rel":"","context":"In "System Settings"","block_context":{"text":"System Settings","link":"https:\/\/support.questetra.com\/en\/category\/system-settings\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-IP-Address-Filtering.png?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-IP-Address-Filtering.png?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-IP-Address-Filtering.png?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-IP-Address-Filtering.png?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2020\/03\/System-Settings-IP-Address-Filtering.png?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/support.questetra.com\/wp-content\/uploads\/2025\/12\/System-Settings-CSP.png?fit=1200%2C675&ssl=1","_links":{"self":[{"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/posts\/179640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/comments?post=179640"}],"version-history":[{"count":38,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/posts\/179640\/revisions"}],"predecessor-version":[{"id":190417,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/posts\/179640\/revisions\/190417"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/media\/179653"}],"wp:attachment":[{"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/media?parent=179640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/categories?post=179640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/tags?post=179640"},{"taxonomy":"faq_section","embeddable":true,"href":"https:\/\/support.questetra.com\/en\/wp-json\/wp\/v2\/faq_section?post=179640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}