> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Sensor

## CSP Sensor Requirements

If your website uses a Content-Security-Policy ([CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)) header, please ensure it includes the required values for the functionality our scripts.

For each of the following CSP directives, if used, make sure to also include the specified source expressions as listed below:

### [script-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)

* `'self'` - Required for 1st-party scripts.
* `'unsafe-inline'` - Not required if `nonce` is used (and applied to the Sensor script) or if both the ABR Manager (Auto-ABR) and DevTools Detection capabilities are disabled.
* `*.px-cloud.net *.px-cdn.net`

### [frame-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src)

* `*.px-cloud.net`

### [connect-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src)

* `'self'` - Required for 1st-party requests.
* `*.px-cloud.net *.px-cdn.net *.pxchk.net *.px-client.net`

In addition to the above, it’s recommended to include the following directive and source expression, as it allows Human Challenge to use multithreading for a specific CPU task, potentially speeding up the solution process:

### [worker-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src)

* `blob:`