Since October 13, every page of our website and apps comes with a content security policy, and your browser enforces it. You won't see a new button or a new screen, and nothing changes in how you use Sinan HQ. This post explains what the policy is, why we added it, how we switched it on, and what it doesn't do.
What a content security policy is
When your browser opens a web page, it loads more than the text you read. It also loads scripts, styles, fonts and pictures, and it connects to other services. Without a policy, a browser loads and runs whatever the page asks for.
A content security policy is a short list of rules that a page sends along with itself. It tells the browser which code and which sources that page may use. The browser blocks anything that isn't on the list. Your browser applies these rules on your own device, so the protection doesn't depend on us remembering to check something.
Think of the list of suppliers you accept deliveries from. If a box arrives from someone who isn't on that list, it doesn't come in, however official the label looks.
Why it matters to you as a shop owner
You use Sinan HQ to see your orders, read your customers' chats and decide on what Sinan proposes. Refunds, cancellations and anything else that can't be undone wait for your tap. Sinan never acts alone on those. Because that tap matters, the pages you tap on should run only the code we put there.
The policy adds a check for exactly that. The browser compares what each page tries to load against the page's own rule list. Code from a source that isn't on the list doesn't run.
It covers your customers too. When they use a Sinan HQ page, the same policy applies, and their browser enforces it the same way yours does.
How we switched it on
A policy that is too strict can break a page. A button stops working, a picture doesn't load, a chat doesn't open. We didn't want you to find that out in the middle of answering a customer, so we turned it on in steps:
- Report-only first. We ran the policy in report-only mode. Browsers told us what they would have blocked but blocked nothing, so we could fix the list before it had any effect on your pages.
- Tested offline. We also tested the policy offline, away from the live site.
- Enforcing since October 13. Only after both steps did we start enforcing it. Since then, browsers block whatever a page's list doesn't allow.
If a page of ours ever behaves oddly, for example something doesn't load that used to, please tell us. A rule list can need adjusting when we add something new, and we would rather hear about it from you than have you work around it.
What you need to do
Nothing. There is no setting to switch on and nothing to install, and your customers don't need to do anything either. Current browsers support content security policies, and the policy reaches your browser with every page you open.
What it doesn't do
We would rather be clear about the limits than oversell this:
- It's one layer, not the whole of our security. It controls what a page may load and run in the browser. It works alongside our other protections and doesn't replace them.
- It doesn't replace keeping your login safe. Your password and your device are still yours to look after.
- It doesn't change who decides. The rule that money and anything that can't be undone waits for you is enforced separately on our side. The policy doesn't loosen or tighten it.
- It covers our pages, not your shop's website. The policy protects the pages Sinan HQ serves. Your own shop's website keeps whatever settings you or your shop platform have chosen.
Why we're writing about something you can't see
Most of what keeps a tool trustworthy is invisible when it works. We think you should still know it's there and what it actually does, in plain words. This change doesn't add a feature. It adds a rule your browser holds us to on every page, every time you open one.
This post was drafted by Sinan HQ's AI Copywriter and reviewed by our founder before publishing.