I tried this CSP:
Header set Content-Security-Policy: "default-src 'self'; script-src 'self' https://www.google-analytics.com; style-src 'self' https://twemoji.maxcdn.com; img-src 'self' https://twemoji.maxcdn.com"
I expected that it would allow my images and CSS from my domain and twemoji maxcdn, and script from my domain and Google Analytics. It doesnt work.
The content is showing, but no CSS! It looks like plain text site with images. Even images from tweemoji not appearing, only the images which hosted in my site are working.
I ever tried
style-src alone. Nothing seems to work. I even tried wildcards too.
When I take out the CSP header, my site loads properly. This is how my website looks when I activate CSP:
What am I doing wrong here? I'm trying to use CSP in a HTTP website. I am adding the above code in .htaccess.
I'd like to get this working and also modify it to allow inline CSS too.