# Mitigate XSS Attacks with Content Security Policy

**URL:** https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243
**Category:** Site Management
**Tags:** how-to, content-security-policy
**Created:** [December 14, 2018, 4:38pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243 "2018-12-14T16:38:20Z")
**Posts on this page:** 1
**Showing post:** 37

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [March 23, 2021, 12:11am UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/37 "2021-03-23T00:11:15Z")

</div>

> [@koen360](#):
>
> Hi just wondering, the [Content-Security-Policy: frame-ancestors ‘none’](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors) directive is one that “will be included in future updates” as mentioned by the OP?

We just landed support for CSP `frame-ancestors` directive. It’s disabled by default for now behind the `content security policy frame ancestors` site setting. You can add domains to the list using via `/admin/customize/embedding` as always.

This directive will be enabled by default in the next release cycle.

---

_[View the full topic](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)._