2

I introduced Content Security Policy (CSP) in a website, nonetheless some of its commands and implications seem to negatively affect Google Page Speed Insights ranking.

That happens in certain CSP configurations (the ones for example which do not introduce 'unsafe-inline'), since by not allowing the introduction of inline style sheets nor inline scripts, a very important security measurement provided by CSP avoiding code injection, the page cannot in these CSP configurations be rendered so fast because inline data avoids page render blockig.

Therefore without 'unsafe-inline' in CSP, it's much harder to get better ranking in Google Page Speed Insights. But CSP 'unsafe-inline' improves security avoiding code injection, therefore I'm trying to find a balance between these two issues, CSP and Google Ranking from Page Insights.

  • Does the existence of Content Security Policy (CSP) affect positively Google ranking?
  • How important is ranking from Google Page Speed Insights in the overall Google Ranking?
  • Inlining JavaScript and CSS is often one of the best performance optimizations you can make. I can't see implementing a security policy that doesn't allow that for myself. – Stephen Ostermiller Apr 23 '18 at 19:34
  • 1
    @StephenOstermiller CSP evaluator from Google says "'unsafe-inline' allows the execution of unsafe in-page scripts and event handlers." – João Pimentel Ferreira Apr 23 '18 at 20:45
  • 1
    It does, but that is how the web has worked for years. There are other ways to prevent XSS attacks such as proper sanitation of inputs. I prefer using frameworks that apply escaping by default and you have to do something special to get data onto the page unescaped. – Stephen Ostermiller Apr 23 '18 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.