# Overwrite/Modify CSP header for panel pages

**URL:** <https://forum.getkirby.com/t/overwrite-modify-csp-header-for-panel-pages/34845>\
**Category:** Questions\
**Tags:** v5\
**Created:** [October 9, 2025, 1:31pm UTC](https://forum.getkirby.com/t/overwrite-modify-csp-header-for-panel-pages/34845 "2025-10-09T13:31:46Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![joscha3000](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/joscha3000/32/12029_2.png) [@joscha3000](https://forum.getkirby.com/u/joscha3000)\
**Post date:** [October 9, 2025, 1:31pm UTC](https://forum.getkirby.com/t/overwrite-modify-csp-header-for-panel-pages/34845/1 "2025-10-09T13:31:46Z")

</div>

My Application had the privilege of being PEN-tested.  
One thing they found and marked as a medium thread was that the csp header in the kirby panel is not sufficient and needs more keywords.

Is it possible to modify the header, which is set here [kirby/src/Panel/Document.php at 0f916becac8a2bc824a72cdb70066ed56b50c0f4 · getkirby/kirby · GitHub](https://github.com/getkirby/kirby/blob/0f916becac8a2bc824a72cdb70066ed56b50c0f4/src/Panel/Document.php#L69) ?  
I tried using route after and before hooks but the Content-Security-Policy gets overriden for these requests. (I can set other headers like “X-Test: Hello“).

I am also not sure i even need further keywords from a security point of view, maybe anyone has insights on this?

Any guidance is greatly appreciated!

 ![Screenshot 2025-10-09 at 15.30.55](https://europe1.discourse-cdn.com/flex017/uploads/getkirby/original/3X/8/0/801569ea02b8872fe7163ae92e51d0f9aa359a7e.png)