I have a server running nginx and I would like to add CSP. However I'm encountering difficulties even after following numerous guides I will either get an error from nginx or they just don't work. Here is what the header looks like at the moment:
add_header Content-Security-Policy "default-src 'self'; \ script-src 'self' google-analytics.com; \ img-src 'self' google-analytics.com;
Using this entry however causes nginx to report that there's an error in the config file. I want to restrict access to both myself and Google Analytics as it's the only thing I'm not serving from nginx.