Trusted sites for external scripts in a store
Key Takeaway
Trusted sites for scripts belong to one Experience Builder site, unlike Trusted URLs in Setup, which cover every site in the org. If the "+ Add Trusted Site" button is missing, change the security level from Strict CSP to Relaxed CSP and click "Allow".
A B2B Commerce store's website is managed in Experience Builder. In Experience Builder, the site's Content Security Policy (CSP) security level controls which scripts the site can run. Sometimes a store needs a script hosted outside Salesforce, such as a third-party JavaScript file. In that case, you add the external host as a trusted site so the script can load.
CSP security levels
Each Experience Builder site has a "Security level" setting. Strict CSP is the default security level for sites created in Spring '19 and later.
| Strict CSP | Relaxed CSP | |
|---|---|---|
| Security | Recommended by Salesforce for optimum security | Moderate |
| Inline scripts | All blocked | Allowed to run |
| Remote JavaScript files | All requests blocked unless the host is explicitly allowed | Loaded only from explicitly allowed hosts |
| Where you allow third-party script hosts | "Trusted Sites for Scripts" area, which appears after you select this level | "Trusted Sites for Scripts" area, which appears after you select this level |
| Lightning Locker | Turned on automatically, and you can turn it off | Turned on automatically, and you can turn it off |