Skip to main content

​
Security & CSP

HTML Macro for Confluence uses Content Security Policy (CSP) to control what external resources can load inside the macro iframe. Admins configure the security mode from Confluence Settings → HTML Macro → Security.

​
Security Modes

​
Block All (default)

No external resources load. Only inline HTML, CSS, and JavaScript run. This is the most secure mode and the default for new installations. Best for: Internal widgets, styled text, and custom layouts that don’t need external libraries.

​
Whitelist

Only domains explicitly added to the whitelist can serve resources. All other external URLs are blocked by the browser’s CSP enforcement. Best for: Controlled use of specific CDN libraries or external APIs. To add a domain:
  1. Go to Confluence Settings → HTML Macro → Security
  2. Set mode to Whitelist
  3. Click Add domain
  4. Enter the domain (e.g. cdn.jsdelivr.net)
  5. Save
An empty whitelist behaves like Block all — no domains load until at least one is added.

​
Allow All

Any external URL can load resources. No CSP restrictions are applied. Best for: Trusted internal Confluence instances where all editors are vetted. Not recommended for public-facing or externally accessible Confluence instances.

​
Common Domains to Whitelist

​
Viewer Security

Visitors (non-editors) only see the rendered output of the macro. The source HTML, CSS, and JavaScript are never exposed to viewers, regardless of security mode.