How to fix BitSight CSP findings: A complete guide using CentralCSP

Understanding your BitSight CSP finding

Common BitSight CSP findings:

1. Missing CSP header - No Content Security Policy implemented
2. Weak CSP configuration - Using unsafe keywords like 'unsafe-inline' or 'unsafe-eval'
3. CSP violations - Resources being blocked by your policy
4. Overly permissive policy - Using wildcards (*) or allowing HTTP schemes

Step 1: Assess your current CSP status

Scan your current CSP with our free scanner

• Unsafe keywords that need to be removed
• Missing directives that should be added
• Overly permissive settings that need tightening
• Specific recommendations for your policy
• JSONP endpoints that should be removed
• Other misconfiguration such as missing directives, wrong directives, etc.

Step 2: Collect real violation data

Set up CSP reporting:

1. Create a CentralCSP account to get your reporting endpoint
2. Deploy a strict report-only policy to collect violation data
3. Monitor for 7-14 days to capture all legitimate resource usage

Content-Security-Policy-Report-Only: 
  default-src 'self';
  script-src 'self';
  style-src 'self';
  img-src 'self';
  font-src 'self';
  object-src 'none';
  base-uri 'none';
  form-action 'self';
  frame-ancestors 'none';
  connect-src 'self';
  report-uri https://report.centralcsp.com/YOUR_ENDPOINT;

Step 3: Build your CSP using CentralCSP's Builder

Access the CSP Builder

How the Builder works:

1. Import your violation reports from CentralCSP
2. Review each blocked resource and decide if it's legitimate
3. Add necessary domains to the appropriate directives
4. Generate a production-ready policy

Step 4: Eliminate unsafe keywords systematically

Removing 'unsafe-inline'

// BEFORE (with unsafe-inline)
<script>document.getElementById('button').onclick = function() { alert('clicked'); }</script>

// AFTER (CSP compliant)
<script src="/js/button-handler.js"></script>

// In button-handler.js:
document.getElementById('button').addEventListener('click', function() {
  alert('clicked');
});

• Inline Script Scanner - Detects all inline scripts
• Style Hash Generator - Generate hashes for inline styles
• Builder - Generate a CSP policy based on your website's needs

Step 5: Validate your new CSP

Use the CSP Scanner for final validation:

Validate your new CSP

• ✅ No unsafe keywords present
• ✅ Proper directive structure
• ✅ Appropriate source lists
• ✅ Security best practices followed

Test in report-only mode first:

Step 6: Deploy and monitor

Production deployment:

Content-Security-Policy: 
  default-src 'self';
  script-src 'self' 'nonce-abc123' https://trusted-cdn.com;
  style-src 'self' 'sha256-hash123' https://fonts.googleapis.com;
  img-src 'self' data: https://trusted-images.com;
  font-src 'self' https://fonts.gstatic.com;
  object-src 'none';
  base-uri 'none';
  form-action 'self';
  frame-ancestors 'none';
  connect-src 'self' https://api.yoursite.com;
  report-uri https://report.centralcsp.com/YOUR_ENDPOINT;

Ongoing monitoring with CentralCSP:

• Easy Maintenance with CentralCSP's dashboard
• Violation analytics to track policy effectiveness
• Automated reporting to your security team
• Trend analysis to identify new resources being added

Measuring your BitSight score improvement

• Elimination of CSP violation findings
• Improved overall security rating
• Reduced risk of XSS attacks
• Better compliance with security standards

Get help when you need it

• Free CSP Scanner - Audit your current policy
• CSP Builder - Generate production-ready policies
• Violation Monitoring - Track real-time violations
• Expert Support - Get help with complex implementations

Ready to fix your BitSight CSP findings? Start with our free trial and start monitoring your CSP policy today.