IIS

IIS CSP Setup Guide

Prerequisites

IIS 7.0 or later on Windows Server
Access to your site's web.config file or IIS Manager
A CSP Warden account with a verified domain
Your domain reporting token (found in your CSP Warden dashboard)

Add CSP Header via web.config (Report-Only Mode)

Add a custom header to your site's web.config file:

xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Content-Security-Policy-Report-Only"
             value="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" />
        <!-- Companion header: maps the "csp-endpoint" group named by report-to to your report URL -->
        <add name="Reporting-Endpoints"
             value="csp-endpoint=&quot;https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/&quot;" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

Ship both headers together: report-to names a reporting group (csp-endpoint), and the Reporting-Endpoints header maps that name to the actual HTTPS URL (" is the XML escape for the inner quotes the structured header needs). The legacy report-uri keeps older browsers working.

Add CSP Header via IIS Manager

If you prefer the GUI approach:

Open IIS Manager
Select your site in the left panel
Double-click HTTP Response Headers
Click Add... in the Actions panel
Set Name to Content-Security-Policy-Report-Only
Set Value to your CSP policy string, ending with report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint
Click OK, then Add... a second header named Reporting-Endpoints with value csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/" so report-to can deliver reports (the IIS Manager value field takes the quotes literally)

Switch to Enforcement Mode

After reviewing violations in your CSP Warden dashboard, change the header name fromContent-Security-Policy-Report-Only toContent-Security-Policy:

xml

<customHeaders>
  <add name="Content-Security-Policy"
       value="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" />
  <add name="Reporting-Endpoints"
       value="csp-endpoint=&quot;https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/&quot;" />
</customHeaders>

PowerShell Alternative

You can also configure the header programmatically with PowerShell:

powershell

# Add CSP Report-Only header
Import-Module WebAdministration

$siteName = "Default Web Site"
$headerName = "Content-Security-Policy-Report-Only"
$headerValue = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"

Add-WebConfigurationProperty -PSPath "IIS:\Sites\$siteName" `
  -Filter "system.webServer/httpProtocol/customHeaders" `
  -Name "." `
  -Value @{name=$headerName; value=$headerValue}

# Companion header: maps the "csp-endpoint" group named by report-to to your report URL
# Single-quoted so the inner double quotes stay literal
$reportingValue = 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

Add-WebConfigurationProperty -PSPath "IIS:\Sites\$siteName" `
  -Filter "system.webServer/httpProtocol/customHeaders" `
  -Name "." `
  -Value @{name="Reporting-Endpoints"; value=$reportingValue}

Troubleshooting

Header not appearing: Ensure your web.config is in the root directory of your IIS site and the XML is valid.
500 Internal Server Error: Check for XML syntax errors in web.config. IIS is strict about well-formed XML.
Duplicate headers: If your application also sets CSP headers, remove the duplicate from either web.config or your application code.
Reports not received: Ensure outbound HTTPS connections from your server are not blocked by a firewall or proxy.

<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <httpProtocol> <customHeaders> <add name="Content-Security-Policy-Report-Only" value="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" />  <add name="Reporting-Endpoints" value="csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"" /> </customHeaders> </httpProtocol> </system.webServer> </configuration>

<customHeaders> <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" /> <add name="Reporting-Endpoints" value="csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"" /> </customHeaders>

# Add CSP Report-Only header Import-Module WebAdministration $siteName = "Default Web Site" $headerName = "Content-Security-Policy-Report-Only" $headerValue = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" Add-WebConfigurationProperty -PSPath "IIS:\Sites\$siteName" ` -Filter "system.webServer/httpProtocol/customHeaders" ` -Name "." ` -Value @{name=$headerName; value=$headerValue} # Companion header: maps the "csp-endpoint" group named by report-to to your report URL # Single-quoted so the inner double quotes stay literal $reportingValue = 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"' Add-WebConfigurationProperty -PSPath "IIS:\Sites\$siteName" ` -Filter "system.webServer/httpProtocol/customHeaders" ` -Name "." ` -Value @{name="Reporting-Endpoints"; value=$reportingValue}

Troubleshooting

Header not appearing: Ensure your web.config is in the root directory of your IIS site and the XML is valid.
500 Internal Server Error: Check for XML syntax errors in web.config. IIS is strict about well-formed XML.
Duplicate headers: If your application also sets CSP headers, remove the duplicate from either web.config or your application code.
Reports not received: Ensure outbound HTTPS connections from your server are not blocked by a firewall or proxy.