# Add support for custom CSP and HSTS

**URL:** <https://forum.hercules.app/t/add-support-for-custom-csp-and-hsts/206>\
**Category:** Feature Requests\
**Created:** [May 13, 2026, 9:55am UTC](https://forum.hercules.app/t/add-support-for-custom-csp-and-hsts/206 "2026-05-13T09:55:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jibril\_Bikai](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.hercules.app/jibril_bikai/32/158_2.png) [@Jibril\_Bikai](https://forum.hercules.app/u/Jibril_Bikai)\
**Post date:** [May 13, 2026, 9:55am UTC](https://forum.hercules.app/t/add-support-for-custom-csp-and-hsts/206/1 "2026-05-13T09:55:40Z")

</div>

Please add support for custom HTTP security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy) for hosted apps. This is critical for regulatory compliance (RGPD, NIS2) and affects compliance scanner scores significantly.

---

<div class="post-metadata">

**Author:** ![Arnav](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.hercules.app/arnav/32/8_2.png) [@Arnav](https://forum.hercules.app/u/Arnav)\
**Post date:** [May 13, 2026, 12:17pm UTC](https://forum.hercules.app/t/add-support-for-custom-csp-and-hsts/206/2 "2026-05-13T12:17:16Z")

</div>

Hey @Jibril_Bikai , thanks for raising this. Two of the four are already live:

HSTS and X-Frame-Options ship as opt-in toggles in your app under Settings → Security Headers. You can set the HSTS duration in months, toggle includeSubDomains and preload, and pick DENY or SAMEORIGIN for framing.  
CSP can be set today via a tag inside your app’s HTML, which compliance scanners do detect!

That being said,  
Permissions-Policy has no meta-tag fallback, so it needs platform support. I’ll add it to our roadmap!

---

<div class="post-metadata">

**Author:** ![Brendan](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.hercules.app/brendan/32/60_2.png) [@Brendan](https://forum.hercules.app/u/Brendan)\
**Post date:** [June 28, 2026, 9:11pm UTC](https://forum.hercules.app/t/add-support-for-custom-csp-and-hsts/206/5 "2026-06-28T21:11:14Z")

</div>

FYI this is all possible by chatting with Hercules today. See [Set Security Response Headers | Hercules Changelog](https://hercules.app/changelog/security-response-headers)

---

<div class="post-metadata">

**Author:** ![Brendan](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.hercules.app/brendan/32/60_2.png) [@Brendan](https://forum.hercules.app/u/Brendan)\
**Post date:** [June 28, 2026, 9:11pm UTC](https://forum.hercules.app/t/add-support-for-custom-csp-and-hsts/206/6 "2026-06-28T21:11:17Z")

</div>

Closed on June 28, 2026, 9:11pm UTC