[Marc Cosgrove]

Has anyone experience in setting content-security-policy tags for sites with embedded ecwid? I want to limit the possible sources for scripts, but the ecwid code seems to reference scripts with a variety of domains. I though that checking the headers on the native 'starter'site might help, but there appears to be no tags set.
Anyone know more?

[Alex Flint]

Hi Marc,

It's Alex Flint from Ecwid Customer Care Team. Thanks for reaching us out. I'm here to help you.

Please, let me first explain why there are several sources of transferring content of an Ecwid store to a website, where Ecwid is embedded.

The stability of Ecwid stores is one of our highest priorities. We do our best to keep your store up and running 24/7 without any downtimes. One of the common practices creating a stable platform is dividing the sources, that provide the content of an Ecwid store. This is the reason, why you see several domains that transfer Ecwid content to your website.

Sometimes, change domain names in order to make sure, that our merchants' stores won't be down affected by any domain outages. And, unfortunately, due to such actions, it is not possible to restrict the domains, that provide your website with content for a page, where Ecwid is integrated — I'm sorry.

However, I'd like to tell you, that Ecwid is a highly-secured platform. All the data, that is transferred within your store is encrypted and no one has the access to one. You can learn more on the topic in our article on Customer Data Security in Ecwid

Hope I was helpful. If you have any questions — please, feel free to ask.