We have just upgraded a u13 site which used CSP Manager just fine. Upgraded to 17, CSP to Version 17.0.1, and put live. The CSP is not showing up anywhere, not in Network tab, nor in securityheaders check, for example. I have taken all the settings out and put them back in, nothing. Took out ones that would definitely cause an error on specific pages and nothing. It doesn’t seem to be doing anything at all. When I search for CSP in the Log, all I see is “Saving CSP definition” logs, no errors. Is there an additional step we’re supposed to be doing on 17?
Hi AWatters,
Just want to check the simple things can you screenshot your CSP settings?
Policy Settings | CSP Manager for Umbraco
Thanks
Matt
I’ve just had a play locally - it doesn’t work locally either. Tried uninstalling and reinstalling and no difference.
Looking at the dependencies of the package I assume you have version 3.0.0 installed? If that’s the case Id suggest upgrading to the latest 17.0.1 version which would require you to patch your Umbraco install.
I have version 17.0.1 installed, Umbraco 17.4.2. Also uSkinned 7.0.2 but it always worked with this before.
<ItemGroup>
<PackageReference Include="ClosedXML" Version="0.105.0" />
<PackageReference Include="Our.Umbraco.GMaps" Version="17.0.0" />
<PackageReference Include="Umbraco.Cms" Version="17.4.2" />
<PackageReference Include="Umbraco.Cms.DevelopmentMode.Backoffice" Version="17.4.2" />
<PackageReference Include="Umbraco.Community.CSPManager" Version="17.0.1" />
<PackageReference Include="uSkinnedSiteBuilder" Version="7.0.2" />
<PackageReference Include="Umbraco.Forms" Version="17.3.2" />
<PackageReference Include="uSync" Version="17.3.2" />
</ItemGroup>
Running on IIS, other security headers set up via web.config.
I have another site - site B - which is also upgraded to u17 and CSP is working on this one, locally anyway, it’s not on a server yet. The CSP for site A does not work locally. Site B’s packages are as follows:
<PackageReference Include="Umbraco.Cms" Version="17.4.0" />
<PackageReference Include="Umbraco.Community.CSPManager" Version="17.0.1" />
<PackageReference Include="Umbraco.Forms" Version="17.3.2" />
<PackageReference Include="uSkinnedSiteBuilder" Version="7.0.1" />
<PackageReference Include="uSync" Version="17.3.2" />
So it’s more simple. What site A also has that site B does not have is custom backoffice work, which is just a small form with date pickers which exports data from a custom table into XML format, hence the ClosedXML package. This
code is in a separate project, and it functions correctly in the back office. I am wondering though if there is something going on in there, going to have a look at that now.
hi @awatters 
I think it’s worth checking something before digging further into the custom backoffice code 
Umbraco 17.4 introduced opt-in output caching for Razor-rendered pages release note. Edit : ( search for #22338 )First thing to check: controllers that inherit from RenderController get this automatically once it’s enabled, and a cached response skips the rendering pipeline entirely on subsequent requests including any middleware that runs after the cache, like CSP Manager’s header writer.
Second thing to check: whether that’s actually enabled on your site. A quick way to tell is to look for an Age header in the response (DevTools → Network → Response Headers). If it’s there, you’re getting served from the output cache, which would explain why toggling the CSP settings doesn’t change anything the cached HTML doesn’t change when you flip a setting.
Thank you Bishal, this does not seem to be the issue here. But interesting to know thanks
I think I’m just going to roll my own at this stage, thanks both.
CSP manager does have debug level logging through out can you see what you get if you turn it on?
If the package has an issue I’ll happily fix it
Matt
6/22/2026, 12:50:36 PM
ABCD-FDL8XV3
Retrieved CSP definition “9cbfa28c-2b19-40f4-9f8e-bbc52bd8e780” from cache for “BackOffice”
6/22/2026, 12:32:47 PM
ABCD-FDL8XV3
Retrieved CSP definition “fac780be-53af-41dc-b51d-1aa647100221” from cache for “Frontend”
6/22/2026, 12:32:12 PM
ABCD-FDL8XV3
Loading CSP definition from database for “Frontend”
Timestamp
6/22/2026, 12:32:47 PM
@MessageTemplate
Retrieved CSP definition {DefinitionId} from cache for {Context}
Context:
Frontend
DefinitionId:
fac780be-53af-41dc-b51d-1aa647100221
EventId:
{ Id: 103, Name: “CspDefinitionRetrievedFromCache” }
SourceContext:
Umbraco.Community.CSPManager.Services.CspService
RequestId:
0HNMGA7HJ1E2T:000001BF
RequestPath:
/.well-known/appspecific/com.chrome.devtools.json
ConnectionId:
0HNMGA7HJ1E2T
ProcessId:
27840
ProcessName:
Website17
ThreadId:
21
ApplicationId:
d0354febff166d8ef4bfc36c19161524ea5a3195
MachineName:
ABCD-FDL8XV3
Log4NetLevel:
DEBUG
Thanks Matt - this is all I’m getting, I’ve put the contents of one of the “Retrieved CSP definition” entries up also. Anything exciting there? The GUIDs do match what’s in the database, I just checked.
Nothing breaking… Can I suggest injecting the ICspService onto somewhere and seeing if it’s getting the expected value, or hook into the csp writing notification Notification Events | CSP Manager for Umbraco
If the CSP is correct in both those locations, I am at kind of a loss…
Hi @AWatters,
I have released version 17.0.2 which adds additional logging so we can hopefully see where its failing.
Hope this helps 
Matt
Are you seeing the new logs?
If so and they look all good I suspect another middleware is clearing them possibly within uskinned as it’s the only one I haven’t used myself
Matt
Sorry Matt, I ended up doing it myself in IIS, which is not ideal but work got in the way! I haven’t had a chance to have a look at new logs yet but hope to in the next day or so. Thank you for your work on this!
Finally got a chance to look at this again. Upgraded the package locally and this is now in the logs:
7/7/2026, 5:10:34 PM
SERVER-FDL8XV3
CSP header "Content-Security-Policy" applied for "fac780be-xxxx-xxxx-b51d-1aa647100221" (1083 chars)
7/7/2026, 5:10:34 PM
SERVER-FDL8XV3
Retrieved CSP definition "fac780be-53af-xxxx-xxxx-1aa647100221" from cache for "Frontend"
7/7/2026, 5:10:34 PM
SERVER-FDL8XV3
CSP OnStarting callback fired for "/.well-known/appspecific/com.chrome.devtools.json"
7/7/2026, 5:08:58 PM
SERVER-FDL8XV3
CSP header "Content-Security-Policy" applied for "fac780be-xxxx-xxxx-b51d-1aa647100221" (1083 chars)
7/7/2026, 5:08:58 PM
SERVER-FDL8XV3
Loading CSP definition from database for "Frontend"
7/7/2026, 5:08:58 PM
SERVER-FDL8XV3
CSP OnStarting callback fired for "/.well-known/appspecific/com.chrome.devtools.json"
So Loading when the site starts up and then Retrieved on each page load, it seems. Does this tell you anything?
It suggests that something else might be stripping the headers, I wonder if uskinned does something with headers? (It’s the only package I have not used much)
Matt