# Configure Content-Security-Policy header

## Overview

You can configure the Content-Security-Police HTTP header through the API in the `Program.cs` file of the ASP.NET Core Renderer or via the backend UI, through the *Advanced* settings.

> info **RECOMMENDATION**: We recommend configuring the header via the API, because you have more configuration options. 

When you create directives using the backend UI, you do not need to build and deploy your renderer application. This option is suitable for content editors when they need to quickly allow an external source.

## Configure CSP header via the API 

Perform the following:

1. Open the `Program.cs` file of Sitefinity ASP.NET Core Renderer.

2. Modify the services section to include the required directives.

   > success  **EXAMPLE**: To add a particular website as a secure source, modify the section in the following way:
   >
   > ```C#
   >    using Microsoft.AspNetCore.Builder;
   >    using Microsoft.AspNetCore.Hosting;
   >    using Microsoft.Extensions.Hosting;
   >    using Progress.Sitefinity.AspNetCore;
   >    using Progress.Sitefinity.AspNetCore.FormWidgets;
   >    var builder = WebApplication.CreateBuilder(args);
   >    // Add services to the container.
   >    //Add external source as trusted
   >    builder.Services.AddSitefinity(x => x.CspOptions.CspDelegate = (cspDirectives, httpContext) =>
   >    {
   >        cspDirectives.DefaultSrc += " *.example.com";
   >    });
   >    // Rest of the Program.cs file remains unchanged
   > ```

3. Save and close the `Program.cs` file.

4. Build and deploy the renderer application.

## Configure the CSP header in the backend

Perform the following:

1. In Sitefinity CMS backend, navigate to *Administration* » *Settings* » *Advanced*
2. In the tree on the left, expand *AspNetCoreRenderer* » *Security* » *Content-Security-Policy header*.
3. Click *Directives* » *Create new.*
4. In *Name*, enter the directive and save your changes.
5. In *Value*, enter the value of the directive and save your changes.

For more information, see [CSP header syntax reference](https://www.progress.com/documentation/sitefinity-cms/csp-header-syntax-reference).