When it comes to the security of the cloupages. How can we prevent the external scripts running on the cloud pages and secure our cloud pages from RXSS attacks on the smart capture form fields on the cloud pages?

Please help me with this!

Thanks Adam

  • Does this answer your question? salesforce.stackexchange.com/questions/293342/… Mar 25 at 10:19
  • @RachidMamai When I am using this script on my cloud page, it's damaging the css of my cloud page and whole design it's not working properly. Do you know how can I prevent this?
    – Adam Coder
    Mar 25 at 10:27
  • if you are pulling in CSS from external source, this script will prevent that. so you could host your CSS inside SFMC as code snippet / CSS and use that URL instead. Alternatively, you'd have to make an exclusion in the Content-Security-Policy. Platform.Response.SetResponseHeader("Content-Security-Policy","default-src 'self'"); Mar 25 at 10:36
  • @JonasLamberty Do you know how can I make an exclusion in the content-security-policy for cloud pages in SFMC?
    – Adam Coder
    Mar 25 at 11:03
  • @AdamCoder Did you check my answer below? Mar 26 at 8:12

1 Answer 1


I'm writing this as an answer to give more details.

Jonas already gave you the answer, but I'll provide an example:

Let's say you have:

  • Google API fonts (fonts.googleapis.com...)
  • Javascript hosted in something.jquery.com
  • CSS hosted in external domain domain2.com
  • CSS hosted internally in SFMC as a code resource
  • Favicon hosted in an external domain www.domain3.com/favicon.ico

You need to add all of these as exclusions like below:

     "default-src 'self' *.googleapis.com *.jquery.com *.domain2.com; 
     img-src *.domain3.com");

You can check out this page for all CloudPages security best practices:


  • Thank you @RachidMamai & @JonasLamberty! Let me try this solution.
    – Adam Coder
    Mar 26 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .