Apache/LiteSpeed CSP Setup Guide

• Apache 2.4+ or LiteSpeed/OpenLiteSpeed
• mod_headers module enabled
• A CSP Warden account with a verified domain
• Your domain reporting token (found in your CSP Warden dashboard)

Ensure the mod_headers module is loaded. On Debian/Ubuntu:

sudo a2enmod headers
sudo systemctl restart apache2

On CentOS/RHEL, verify the module is loaded in your Apache configuration:

LoadModule headers_module modules/mod_headers.so

Start with Content-Security-Policy-Report-Only to monitor violations without blocking any resources. Add this to your VirtualHost configuration:

<VirtualHost *:443>
    ServerName yourdomain.com

    # CSP Report-Only - monitors without blocking
    Header set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
    # Companion header: maps the "csp-endpoint" group named by report-to to your report URL
    Header set Reporting-Endpoints csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"

    # ... your existing VirtualHost config ...
</VirtualHost>

Ship both headers together: report-to names a reporting group (csp-endpoint), and the Reporting-Endpoints header maps that name to the actual HTTPS URL. The legacy report-uri keeps older browsers working. Leave the Reporting-Endpoints value unquoted: it already carries its own double quotes and has no spaces, so Apache takes it verbatim. No backslash-escaping is needed - and you must not add any. Wrapping the value in Apache's own quotes would force escaping the inner quotes as \", which LiteSpeed mis-parses into an empty csp-endpoint= value - silently breaking Reporting-API delivery.

Alternatively, you can use .htaccess if your hosting provider doesn't allow direct VirtualHost edits:

# .htaccess
Header set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
Header set Reporting-Endpoints csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"

Once you've reviewed the violation reports in your CSP Warden dashboard and refined your policy, switch from Content-Security-Policy-Report-Only to Content-Security-Policy:

# Enforce CSP - blocks violating resources and reports
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
Header set Reporting-Endpoints csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"

Apply your changes:

sudo systemctl restart apache2

• Header not appearing: Verify mod_headers is loaded with apachectl -M | grep headers.
• Reports not received: Check that the report-uri URL matches your domain token exactly and is HTTPS.
• .htaccess not working: Ensure AllowOverride All is set in your VirtualHost or directory configuration.