If you’re hosting your Next.js app on a server (Node.js or Express), or using a serverless platform like Vercel, you can set HTTP headers, including the Content Security Policy, using Next.js’ built-in next.config.js. Here’s how to configure the CSP header in next.config.js: Exampe if you are using google analytics