# CSP on Monzo.me **URL:** \ **Category:** Help\ **Created:** [3 April 2017 08:51 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090 "2017-04-03T08:51:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![\_Colin\_W](https://avatars.discourse-cdn.com/v4/letter/_/94ad74/32.png) [@\_Colin\_W](https://community.monzo.com/u/_Colin_W)\ **Post date:** [3 April 2017 08:51 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090/1 "2017-04-03T08:51:14Z")
Similar to this helpful topic about HSTS… > [@CSP/HSTS/HPKP (security headers) on Monzo.me](https://community.monzo.com/t/hsts-on-monzo-me/8089): > > This is not so much a bug report as a question. Why is HSTS not deployed on [monzo.me](http://monzo.me)? It’s a system that pretty much has to be completely secure considering what it handles. I’d say it’s a big target. Without HSTS the site is vulnerable to sslstrip attacks and similar. Some kind of certificate pinning is really needed. HSTS is of course a trust-on-first-connection system, so you could even go further and include the certificate directly in major browsers, but HSTS is a must at minimum. … should the Content Security Policy HTTP response header also not be defined on all TLS websites in Monzo’s portfolio? It can [help reduce](https://content-security-policy.com/) cross-site scripting risk, and missing security controls like this would be reported as a vulnerability in application security testing. ---
**Author:** ![anon44204028](https://avatars.discourse-cdn.com/v4/letter/a/ed655f/32.png) [@anon44204028](https://community.monzo.com/u/anon44204028)\ **Post date:** [3 April 2017 09:27 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090/2 "2017-04-03T09:27:55Z")
It is probably better to have this type of discussion in the Monzo Developer’s Slack channel. It’s easier to have a quick back and forth conversation with the members of the team who deal with this sort of thing there & the average non-techie user will definately have no idea what you are on about in this community ---
**Author:** ![billinghamj](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/billinghamj/32/131_2.png) [@billinghamj](https://community.monzo.com/u/billinghamj)\ **Post date:** [3 April 2017 10:00 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090/3 "2017-04-03T10:00:00Z")
@alexs Probably worth considering this as being a duplicate and merging it into [CSP/HSTS/HPKP (security headers) on Monzo.me](https://community.monzo.com/t/hsts-on-monzo-me/8089/3) ---
**Author:** ![alexs](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alexs/32/2443_2.png) [@alexs](https://community.monzo.com/u/alexs)\ **Post date:** [3 April 2017 10:08 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090/4 "2017-04-03T10:08:48Z")
A post was merged into an existing topic: [CSP/HSTS/HPKP (security headers) on Monzo.me](https://community.monzo.com/t/csp-hsts-hpkp-security-headers-on-monzo-me/8089) ---
**Author:** ![alexs](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alexs/32/2443_2.png) [@alexs](https://community.monzo.com/u/alexs)\ **Post date:** [3 April 2017 10:09 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090/5 "2017-04-03T10:09:11Z")
---
**Author:** ![alexs](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alexs/32/2443_2.png) [@alexs](https://community.monzo.com/u/alexs)\ **Post date:** [3 April 2017 10:09 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090/6 "2017-04-03T10:09:13Z")
---
**Author:** ![alexs](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alexs/32/2443_2.png) [@alexs](https://community.monzo.com/u/alexs)\ **Post date:** [3 April 2017 10:09 UTC](https://community.monzo.com/t/csp-on-monzo-me/8090/7 "2017-04-03T10:09:15Z")