diff --git a/.phpstan.dist.baseline.neon b/.phpstan.dist.baseline.neon
index 2629281782e..48a3cd27e25 100644
--- a/.phpstan.dist.baseline.neon
+++ b/.phpstan.dist.baseline.neon
@@ -5496,6 +5496,30 @@ parameters:
 			count: 1
 			path: app/design/adminhtml/default/default/template/system/config/form/field/array.phtml
 
+		-
+			message: '#^Access to protected property Mage_Adminhtml_Block_System_Config_Form_Field_Csp_Hosts\:\:\$_addAfter\.$#'
+			identifier: property.protected
+			count: 4
+			path: app/design/adminhtml/default/default/template/system/config/form/field/csp.phtml
+
+		-
+			message: '#^Access to protected property Mage_Adminhtml_Block_System_Config_Form_Field_Csp_Hosts\:\:\$_addButtonLabel\.$#'
+			identifier: property.protected
+			count: 2
+			path: app/design/adminhtml/default/default/template/system/config/form/field/csp.phtml
+
+		-
+			message: '#^Access to protected property Mage_Adminhtml_Block_System_Config_Form_Field_Csp_Hosts\:\:\$_columns\.$#'
+			identifier: property.protected
+			count: 5
+			path: app/design/adminhtml/default/default/template/system/config/form/field/csp.phtml
+
+		-
+			message: '#^Call to protected method _renderCellTemplate\(\) of class Mage_Adminhtml_Block_System_Config_Form_Field_Csp_Hosts\.$#'
+			identifier: method.protected
+			count: 2
+			path: app/design/adminhtml/default/default/template/system/config/form/field/csp.phtml
+
 		-
 			message: '#^Unreachable statement \- code above always terminates\.$#'
 			identifier: deadCode.unreachable
diff --git a/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/Array/Abstract.php b/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/Array/Abstract.php
index d7027d7f38f..3bd3eebbcf4 100644
--- a/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/Array/Abstract.php
+++ b/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/Array/Abstract.php
@@ -17,7 +17,7 @@ abstract class Mage_Adminhtml_Block_System_Config_Form_Field_Array_Abstract exte
     /**
      * Grid columns
      *
-     * @var array
+     * @var array<string, array{label: string, size: string|false, style: ?string, class: ?string, renderer: Mage_Core_Block_Abstract|false}>
      */
     protected $_columns = [];
 
@@ -38,9 +38,9 @@ abstract class Mage_Adminhtml_Block_System_Config_Form_Field_Array_Abstract exte
     /**
      * Rows cache
      *
-     * @var array|null
+     * @var array<string, Varien_Object>|null
      */
-    private $_arrayRowsCache;
+    protected $_arrayRowsCache;
 
     /**
      * Indication whether block is prepared to render or no
diff --git a/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/Csp/Hosts.php b/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/Csp/Hosts.php
new file mode 100644
index 00000000000..70aad2dc17f
--- /dev/null
+++ b/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/Csp/Hosts.php
@@ -0,0 +1,152 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Open Software License (OSL 3.0)
+ * @package    Mage_Csp
+ */
+
+/**
+ * Base class for CSP hosts field renderer
+ */
+class Mage_Adminhtml_Block_System_Config_Form_Field_Csp_Hosts extends Mage_Adminhtml_Block_System_Config_Form_Field_Array_Abstract
+{
+    protected Mage_Csp_Helper_Data $helper;
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+        /** @var Mage_Csp_Helper_Data $helper */
+        $helper = Mage::helper('csp');
+        $this->helper = $helper;
+        $this->addColumn('host', [
+            'label' => Mage::helper('csp')->__('Host'),
+        ]);
+
+        $this->_addAfter = false;
+        $this->_addButtonLabel = Mage::helper('csp')->__('Add Host');
+        $this->setTemplate('system/config/form/field/csp.phtml');
+
+        parent::__construct();
+    }
+
+    /**
+     * Obtain existing data from form element
+     *
+     * Each row will be instance of Varien_Object
+     * @return array<string, Varien_Object> Array of rows
+     * @throws Exception
+     */
+    public function getArrayRows(): array
+    {
+        if ($this->_arrayRowsCache !== null) {
+            return $this->_arrayRowsCache;
+        }
+
+        $result = [];
+
+        [$area, $directiveName] = $this->_parseNodePath();
+
+        $globalPolicy = $this->helper->getGlobalPolicy($directiveName);
+        if ($globalPolicy) {
+            foreach ($globalPolicy as $key => $host) {
+                $rowId = $directiveName . '_xml_' . $area . '_' . $key;
+                $result[$rowId] = new Varien_Object([
+                    'host' => $host,
+                    'readonly' => 'readonly="readonly"',
+                    '_id' => $rowId,
+                    'area' => 'global',
+                ]);
+                $this->_prepareArrayRow($result[$rowId]);
+            }
+        }
+
+        $areaPolicy = $this->helper->getAreaPolicy($area, $directiveName);
+        if ($areaPolicy) {
+            foreach ($areaPolicy as $key => $host) {
+                $rowId = $directiveName . '_xml_' . $area . '_' . $key;
+                $result[$rowId] = new Varien_Object([
+                    'host' => $host,
+                    'readonly' => 'readonly="readonly"',
+                    '_id' => $rowId,
+                    'area' => $area,
+                ]);
+                $this->_prepareArrayRow($result[$rowId]);
+            }
+        }
+
+        $configPolicy = $this->helper->getStoreConfigPolicy($area, $directiveName);
+        if ($configPolicy) {
+            foreach ($configPolicy as $key => $value) {
+                $rowId = $directiveName . '_' . $area . '_' . $key;
+                $result[$rowId] = new Varien_Object([
+                    'host' => $this->escapeHtml($value),
+                    '_id' => $rowId,
+                ]);
+
+                $this->_prepareArrayRow($result[$rowId]);
+            }
+        }
+
+        $this->_arrayRowsCache = $result;
+        return $this->_arrayRowsCache;
+    }
+
+    /**
+     * Extract and validate area and directive name from the node path
+     *
+     * @return array{Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML, value-of<Mage_Csp_Helper_Data::CSP_DIRECTIVES>} Array containing area and directiveName
+     * @throws Exception If path format is invalid or contains disallowed values
+     */
+    private function _parseNodePath(): array
+    {
+        /** @var Varien_Data_Form_Element_Abstract $element */
+        $element = $this->getElement();
+        $configPath = $element->getData('config_path');
+
+        $allowedDirectives = implode('|', Mage_Csp_Helper_Data::CSP_DIRECTIVES);
+        $allowedAreas = Mage_Core_Model_App_Area::AREA_FRONTEND . '|' . Mage_Core_Model_App_Area::AREA_ADMINHTML;
+
+        $pattern = "#csp/({$allowedAreas})/({$allowedDirectives})#";
+
+        if (!$configPath || !preg_match($pattern, $configPath, $matches)) {
+            throw new Exception('Invalid node path format or disallowed area/directive');
+        }
+
+        $area = $matches[1];
+        $directiveName = $matches[2];
+
+        return [$area, $directiveName];
+    }
+
+    /**
+     * Render array cell for prototypeJS template
+     *
+     * @param string $columnName
+     * @return string
+     * @throws Exception
+     */
+    protected function _renderCellTemplate($columnName)
+    {
+        if (empty($this->_columns[$columnName])) {
+            throw new Exception('Wrong column name specified.');
+        }
+
+        $column      = $this->_columns[$columnName];
+        /** @var Varien_Data_Form_Element_Text $element */
+        $element     = $this->getElement();
+        $elementName = $element->getName();
+        $inputName   = $elementName . '[#{_id}][' . $columnName . ']';
+
+        return '<input type="text" name="' . $inputName . '" value="#{' . $columnName . '}" ' .
+            '#{readonly}' .
+            ($column['size'] ? 'size="' . $column['size'] . '"' : '') . ' class="' .
+            ($column['class'] ?? 'input-text') . '"' .
+            (isset($column['style']) ? ' style="' . $column['style'] . '"' : '') . '/>';
+    }
+}
diff --git a/app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized.php b/app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized.php
index d3b4d3a4b61..d1cdd7be946 100644
--- a/app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized.php
+++ b/app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized.php
@@ -20,7 +20,7 @@ protected function _afterLoad()
         if (!is_array($this->getValue())) {
             $serializedValue = $this->getValue();
             $unserializedValue = false;
-            if (!empty($serializedValue)) {
+            if (!empty($serializedValue) && is_string($serializedValue)) {
                 try {
                     $unserializedValue = Mage::helper('core/unserializeArray')
                         ->unserialize((string) $serializedValue);
diff --git a/app/code/core/Mage/Csp/Block/Adminhtml/Meta.php b/app/code/core/Mage/Csp/Block/Adminhtml/Meta.php
new file mode 100644
index 00000000000..016884d056d
--- /dev/null
+++ b/app/code/core/Mage/Csp/Block/Adminhtml/Meta.php
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Open Software License (OSL 3.0)
+ * @package    Mage_Csp
+ */
+
+/**
+ * CSP Meta Block
+ *
+ * @package Mage_Csp
+ */
+class Mage_Csp_Block_Adminhtml_Meta extends Mage_Csp_Block_Meta
+{
+    protected string $area = Mage_Core_Model_App_Area::AREA_ADMINHTML;
+}
diff --git a/app/code/core/Mage/Csp/Block/Meta.php b/app/code/core/Mage/Csp/Block/Meta.php
new file mode 100644
index 00000000000..ada93aeee84
--- /dev/null
+++ b/app/code/core/Mage/Csp/Block/Meta.php
@@ -0,0 +1,105 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Open Software License (OSL 3.0)
+ * @package    Mage_Csp
+ */
+
+/**
+ * CSP Meta Block
+ *
+ * @package Mage_Csp
+ */
+class Mage_Csp_Block_Meta extends Mage_Core_Block_Template
+{
+    /**
+     * CSP directives
+     * @var array<value-of<Mage_Csp_Helper_Data::CSP_DIRECTIVES>, array<string>>
+     */
+    protected array $directives = [];
+
+    /**
+     * CSP meta tag area
+     * @var Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML
+     */
+    protected string $area = Mage_Core_Model_App_Area::AREA_FRONTEND;
+
+    /**
+     * Add CSP directive
+     *
+     * @param value-of<Mage_Csp_Helper_Data::CSP_DIRECTIVES> $directive
+     */
+    public function addDirective(string $directive, string $value): static
+    {
+        if (!in_array($directive, Mage_Csp_Helper_Data::CSP_DIRECTIVES)) {
+            return $this;
+        }
+
+        if (!isset($this->directives[$directive])) {
+            $this->directives[$directive] = [];
+        }
+
+        $this->directives[$directive][] = $value;
+
+        return $this;
+    }
+
+    /**
+     * Get CSP directives
+     * @return array<value-of<Mage_Csp_Helper_Data::CSP_DIRECTIVES>, array<string>>
+     */
+    public function getDirectives(): array
+    {
+        return $this->directives;
+    }
+
+    /**
+     * Get CSP policy content
+     */
+    public function getContents(): string
+    {
+        $content = [];
+        foreach ($this->directives as $directive => $values) {
+            if (!empty($values)) {
+                $content[] = $directive . ' ' . implode(' ', $values);
+            }
+        }
+        $content = implode('; ', $content);
+        return trim($content);
+    }
+
+    /**
+     * Render CSP meta tag if enabled
+     */
+    protected function _toHtml(): string
+    {
+        if (empty($this->directives)) {
+            return '';
+        }
+
+        /** @var Mage_Csp_Helper_Data $helper */
+        $helper = Mage::helper('csp');
+        if (!$helper->isEnabled($this->area) || $helper->shouldMergeMeta($this->area)) {
+            return '';
+        }
+
+        $headerValue = $this->getContents();
+        if (!empty($helper->getReportUri($this->area))) {
+            $reportUriEndpoint = trim($helper->getReportUri($this->area));
+            $headerValue .= '; report-uri ' . $reportUriEndpoint;
+        }
+        $headerName = $helper->getReportOnly($this->area)
+            ? Mage_Csp_Helper_Data::HEADER_CONTENT_SECURITY_POLICY_REPORT_ONLY
+            : Mage_Csp_Helper_Data::HEADER_CONTENT_SECURITY_POLICY;
+
+        return sprintf(
+            '<meta http-equiv="%s" content="%s" />' . PHP_EOL,
+            $headerName,
+            $headerValue,
+        );
+    }
+}
diff --git a/app/code/core/Mage/Csp/Helper/Data.php b/app/code/core/Mage/Csp/Helper/Data.php
new file mode 100644
index 00000000000..3b690af5e70
--- /dev/null
+++ b/app/code/core/Mage/Csp/Helper/Data.php
@@ -0,0 +1,187 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Open Software License (OSL 3.0)
+ * @package    Mage_Csp
+ */
+
+class Mage_Csp_Helper_Data extends Mage_Core_Helper_Abstract
+{
+    public const XML_CPS_ENABLED = 'csp/%s/enabled';
+    public const XML_CSP_REPORT_ONLY = 'csp/%s/report_only';
+    public const XML_CSP_REPORT_URI = 'csp/%s/report_uri';
+    public const XML_CSP_SPLIT_HEADERS = 'csp/%s/split_headers';
+    public const XML_CSP_MERGE_META = 'csp/%s/merge_meta';
+    public const HEADER_CONTENT_SECURITY_POLICY = 'Content-Security-Policy';
+    public const HEADER_CONTENT_SECURITY_POLICY_REPORT_ONLY = 'Content-Security-Policy-Report-Only';
+    public const HEADER_CONTENT_SECURITY_POLICY_REPORT_URI = 'Reporting-Endpoints';
+    public const CSP_DIRECTIVES = [
+        'default-src',
+        'script-src',
+        'style-src',
+        'img-src',
+        'connect-src',
+        'font-src',
+        'frame-src',
+        'object-src',
+        'media-src',
+        'form-action',
+    ];
+
+    protected $_moduleName = 'Mage_Csp';
+
+
+    /**
+     * Check if CSP is enabled
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     */
+    public function isEnabled(string $area): bool
+    {
+        return Mage::getStoreConfigFlag(sprintf(self::XML_CPS_ENABLED, $area));
+    }
+
+    /**
+     * Check if report only mode is enabled
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     */
+    public function getReportOnly(string $area): bool
+    {
+        return Mage::getStoreConfigFlag(sprintf(self::XML_CSP_REPORT_ONLY, $area));
+    }
+
+    /**
+     * Get report uri
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     */
+    public function getReportUri(string $area): string
+    {
+        $config = Mage::getStoreConfig(sprintf(self::XML_CSP_REPORT_URI, $area));
+        return is_string($config) ? $config : '';
+    }
+
+    /**
+     * Check if CSP headers should be split into multiple headers for each directive
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     */
+    public function shouldSplitHeaders(string $area): bool
+    {
+        return Mage::getStoreConfigFlag(sprintf(self::XML_CSP_SPLIT_HEADERS, $area));
+    }
+
+    /**
+     * Check if CSP meta tags should be merged into a single header
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     */
+    public function shouldMergeMeta(string $area): bool
+    {
+        return Mage::getStoreConfigFlag(sprintf(self::XML_CSP_MERGE_META, $area));
+    }
+
+    /**
+     * Get the appropriate CSP header based on the area and report only mode
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     */
+    public function getReportOnlyHeader(string $area): string
+    {
+        return $this->getReportOnly($area) ? self::HEADER_CONTENT_SECURITY_POLICY_REPORT_ONLY : self::HEADER_CONTENT_SECURITY_POLICY;
+    }
+
+    /**
+     * Get CSP policies for a specific area
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     * @return array<string, array<string>>
+     */
+    public function getPolicies(string $area = Mage_Core_Model_App_Area::AREA_FRONTEND): array
+    {
+        if (!$this->isEnabled($area)) {
+            return [];
+        }
+        $policy = [];
+        foreach (self::CSP_DIRECTIVES as $directiveName) {
+            $policy[$directiveName] = [];
+            $policy[$directiveName] = array_merge_recursive(
+                $this->getGlobalPolicy($directiveName),
+                $this->getAreaPolicy($area, $directiveName),
+                $this->getStoreConfigPolicy($area, $directiveName),
+            );
+            $policy[$directiveName] = array_unique($policy[$directiveName]);
+        }
+
+        /** @var array<string, array<string>> $policy */
+        return $policy;
+    }
+
+    /**
+     * Get global policy for a specific directive
+     * global/csp/<directiveName>
+     * @param value-of<self::CSP_DIRECTIVES> $directiveName
+     * @return array<string>
+     */
+    public function getGlobalPolicy(string $directiveName = 'default-src'): array
+    {
+        $config = Mage::getConfig();
+        if (!$config) {
+            return [];
+        }
+
+        $globalNode = $config->getNode(sprintf('global/csp/%s', $directiveName));
+        if ($globalNode) {
+            /** @var array<string> $result */
+            $result = $globalNode->asArray();
+            return $result;
+        }
+        return [];
+    }
+
+    /**
+     * Get area policy for a specific directive
+     * (adminhtml|frontend)/csp/<directiveName>
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     * @param value-of<self::CSP_DIRECTIVES> $directiveName
+     * @return array<string>
+     */
+    public function getAreaPolicy(string $area = Mage_Core_Model_App_Area::AREA_FRONTEND, string $directiveName = 'default-src'): array
+    {
+        $config = Mage::getConfig();
+        if (!$config) {
+            return [];
+        }
+
+        $areaNode = $config->getNode(sprintf('%s/csp/%s', $area, $directiveName));
+        if ($areaNode) {
+            /** @var array<string> $result */
+            $result = $areaNode->asArray();
+            return $result;
+        }
+        return [];
+    }
+
+
+    /**
+     * Get system policy for a specific directive
+     * csp/(adminhtml|frontend)/<directiveName>
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     * @param value-of<self::CSP_DIRECTIVES> $directiveName
+     * @return array<string>
+     */
+    public function getStoreConfigPolicy(string $area = Mage_Core_Model_App_Area::AREA_FRONTEND, string $directiveName = 'default-src'): array
+    {
+        /** @var array<string>|null $systemNode */
+        $systemNode = Mage::getStoreConfig(sprintf('csp/%s/%s', $area, $directiveName));
+        if ($systemNode) {
+            if (is_string($systemNode) && preg_match('/^a:\d+:{.*}$/', $systemNode)) {
+                $unserializedData = unserialize($systemNode);
+                if (is_array($unserializedData)) {
+                    /** @var array<string> $systemNode */
+                    $systemNode = array_column($unserializedData, 'host');
+                }
+            }
+            return $systemNode;
+        }
+        return [];
+    }
+}
diff --git a/app/code/core/Mage/Csp/Model/Observer/Abstract.php b/app/code/core/Mage/Csp/Model/Observer/Abstract.php
new file mode 100644
index 00000000000..dce0af6b2f3
--- /dev/null
+++ b/app/code/core/Mage/Csp/Model/Observer/Abstract.php
@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Open Software License (OSL 3.0)
+ * @package    Mage_Csp
+ */
+
+abstract class Mage_Csp_Model_Observer_Abstract
+{
+    /**
+     * Common method to add CSP headers for a specific area
+     *
+     * @param Mage_Core_Model_App_Area::AREA_FRONTEND|Mage_Core_Model_App_Area::AREA_ADMINHTML $area
+     * @throws Zend_Controller_Response_Exception
+     */
+    protected function addCspHeaders(Varien_Event_Observer $observer, string $area): void
+    {
+        /** @var Mage_Core_Controller_Response_Http $response */
+        $response = $observer->getEvent()->getDataByKey('response');
+        if (!$response || !$response->canSendHeaders(true)) {
+            return;
+        }
+
+        /** @var Mage_Csp_Helper_Data $helper */
+        $helper = Mage::helper('csp');
+        if (!$helper->isEnabled($area)) {
+            return;
+        }
+
+        $directives = $helper->getPolicies($area);
+        if (empty($directives)) {
+            return;
+        }
+
+        // Merge meta directives if needed
+        if ($helper->shouldMergeMeta($area)) {
+            $blockCspMeta = Mage::app()->getLayout()->getBlock('csp_meta');
+            if ($blockCspMeta instanceof Mage_Csp_Block_Meta) {
+                $metaDirectives = $blockCspMeta->getDirectives();
+                foreach ($metaDirectives as $directive => $values) {
+                    $directives[$directive] = array_unique(
+                        array_merge($directives[$directive] ?? [], $values),
+                    );
+                }
+            }
+        }
+
+        // Set the CSP Reporting-Endpoints header
+        $reportUriEndpoint = null;
+        if (!empty($helper->getReportUri($area))) {
+            $reportUriEndpoint = trim($helper->getReportUri($area));
+            $response->setHeader(
+                Mage_Csp_Helper_Data::HEADER_CONTENT_SECURITY_POLICY_REPORT_URI,
+                sprintf('csp-endpoint="%s"', $reportUriEndpoint),
+            );
+        }
+
+        $cspDirectives = $this->_compactHeaders($directives);
+        // Check if the CSP directives should be split into multiple headers
+        $shouldSplitHeaders = $helper->shouldSplitHeaders($area);
+        if ($shouldSplitHeaders !== true) {
+            $headerValue = implode('; ', $cspDirectives);
+            $cspDirectives = [$headerValue];
+        }
+        // Set the CSP headers
+        $headerName = $helper->getReportOnly($area)
+            ? Mage_Csp_Helper_Data::HEADER_CONTENT_SECURITY_POLICY_REPORT_ONLY
+            : Mage_Csp_Helper_Data::HEADER_CONTENT_SECURITY_POLICY;
+        foreach ($cspDirectives as $headerValue) {
+            if ($reportUriEndpoint !== null) {
+                $headerValue .= '; report-uri ' . $reportUriEndpoint;
+                $headerValue .= '; report-to csp-endpoint';
+            }
+            $response->setHeader($headerName, $headerValue);
+        }
+    }
+
+    /**
+     * Compact the CSP directives into a single string for each directive
+     * @param array<string, array<string>> $directives
+     * @return array<string>
+     */
+    private function _compactHeaders(array $directives): array
+    {
+        $cspParts = [];
+        foreach ($directives as $directive => $values) {
+            if (!empty($values)) {
+                $cspParts[$directive] = $directive . ' ' . implode(' ', $values);
+            }
+        }
+        return $cspParts;
+    }
+}
diff --git a/app/code/core/Mage/Csp/Model/Observer/AddAdminCspHeaders.php b/app/code/core/Mage/Csp/Model/Observer/AddAdminCspHeaders.php
new file mode 100644
index 00000000000..d2252a19be4
--- /dev/null
+++ b/app/code/core/Mage/Csp/Model/Observer/AddAdminCspHeaders.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Open Software License (OSL 3.0)
+ * @package    Mage_Csp
+ */
+
+class Mage_Csp_Model_Observer_AddAdminCspHeaders extends Mage_Csp_Model_Observer_Abstract
+{
+    /**
+     * Add Content Security Policy headers to the admin response
+     */
+    public function execute(Varien_Event_Observer $observer): void
+    {
+        $this->addCspHeaders($observer, Mage_Core_Model_App_Area::AREA_ADMINHTML);
+    }
+}
diff --git a/app/code/core/Mage/Csp/Model/Observer/AddFrontendCspHeaders.php b/app/code/core/Mage/Csp/Model/Observer/AddFrontendCspHeaders.php
new file mode 100644
index 00000000000..13a462c910c
--- /dev/null
+++ b/app/code/core/Mage/Csp/Model/Observer/AddFrontendCspHeaders.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Open Software License (OSL 3.0)
+ * @package    Mage_Csp
+ */
+
+class Mage_Csp_Model_Observer_AddFrontendCspHeaders extends Mage_Csp_Model_Observer_Abstract
+{
+    /**
+     * Add Content Security Policy headers to the frontend response
+     */
+    public function execute(Varien_Event_Observer $observer): void
+    {
+        $this->addCspHeaders($observer, Mage_Core_Model_App_Area::AREA_FRONTEND);
+    }
+}
diff --git a/app/code/core/Mage/Csp/etc/adminhtml.xml b/app/code/core/Mage/Csp/etc/adminhtml.xml
new file mode 100644
index 00000000000..23be2a9910d
--- /dev/null
+++ b/app/code/core/Mage/Csp/etc/adminhtml.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Academic Free License (AFL 3.0)
+ * @package    Mage_Csp
+ */
+-->
+<config>
+    <acl>
+        <resources>
+            <admin>
+                <children>
+                    <system>
+                        <children>
+                            <config>
+                                <children>
+                                    <csp translate="title" module="csp">
+                                        <title>CSP Protection</title>
+                                        <sort_order>70</sort_order>
+                                    </csp>
+                                </children>
+                            </config>
+                        </children>
+                    </system>
+                </children>
+            </admin>
+        </resources>
+    </acl>
+</config>
diff --git a/app/code/core/Mage/Csp/etc/config.xml b/app/code/core/Mage/Csp/etc/config.xml
new file mode 100644
index 00000000000..108156f26ff
--- /dev/null
+++ b/app/code/core/Mage/Csp/etc/config.xml
@@ -0,0 +1,170 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Academic Free License (AFL 3.0)
+ * @package    Mage_Csp
+ */
+-->
+<config>
+    <modules>
+        <Mage_Csp>
+            <version>1.0.0</version>
+        </Mage_Csp>
+    </modules>
+    <global>
+        <blocks>
+            <csp>
+                <class>Mage_Csp_Block</class>
+            </csp>
+        </blocks>
+        <helpers>
+            <csp>
+                <class>Mage_Csp_Helper</class>
+            </csp>
+        </helpers>
+        <models>
+            <csp>
+                <class>Mage_Csp_Model</class>
+            </csp>
+        </models>
+        <csp>
+            <default-src>
+                <self>'self'</self>
+            </default-src>
+            <script-src>
+                <self>'self'</self>
+            </script-src>
+            <style-src>
+                <self>'self'</self>
+            </style-src>
+            <img-src>
+                <self>'self'</self>
+                <data-protocol>data:</data-protocol>
+            </img-src>
+            <connect-src>
+                <self>'self'</self>
+            </connect-src>
+            <font-src>
+                <self>'self'</self>
+            </font-src>
+            <frame-src>
+                <self>'self'</self>
+            </frame-src>
+            <media-src>
+                <self>'self'</self>
+            </media-src>
+            <object-src>
+                <none>'none'</none>
+            </object-src>
+            <form-action>
+                <self>'self'</self>
+            </form-action>
+        </csp>
+    </global>
+    <frontend>
+        <layout>
+            <updates>
+                <csp_meta>
+                    <file>csp.xml</file>
+                </csp_meta>
+            </updates>
+        </layout>
+        <events>
+            <http_response_send_before>
+                <observers>
+                    <csp_observer>
+                        <class>csp/observer_addFrontendCspHeaders</class>
+                        <method>execute</method>
+                    </csp_observer>
+                </observers>
+            </http_response_send_before>
+        </events>
+    </frontend>
+    <adminhtml>
+        <layout>
+            <updates>
+                <csp_meta>
+                    <file>csp.xml</file>
+                </csp_meta>
+            </updates>
+        </layout>
+        <csp>
+            <script-src>
+                <unsafe-inline>'unsafe-inline'</unsafe-inline>
+            </script-src>
+            <style-src>
+                <unsafe-inline>'unsafe-inline'</unsafe-inline>
+            </style-src>
+        </csp>
+        <events>
+            <http_response_send_before>
+                <observers>
+                    <csp_observer>
+                        <class>csp/observer_addAdminCspHeaders</class>
+                        <method>execute</method>
+                    </csp_observer>
+                </observers>
+            </http_response_send_before>
+        </events>
+    </adminhtml>
+    <default>
+        <csp>
+            <frontend>
+                <report_only>1</report_only>
+                <split_headers>0</split_headers>
+                <merge_meta>1</merge_meta>
+                <script-src>
+                    <unsafe-inline>'unsafe-inline'</unsafe-inline>
+                    <unsafe-eval>'unsafe-eval'</unsafe-eval>
+                    <google-analytics>www.google-analytics.com</google-analytics>
+                    <gtm>www.googletagmanager.com</gtm>
+                    <doubleclick>stats.g.doubleclick.net</doubleclick>
+                    <paypal>www.paypal.com</paypal>
+                    <paypal-objects>www.paypalobjects.com</paypal-objects>
+                    <stripe>js.stripe.com</stripe>
+                    <facebook>connect.facebook.net</facebook>
+                </script-src>
+                <style-src>
+                    <unsafe-inline>'unsafe-inline'</unsafe-inline>
+                    <google-fonts>fonts.googleapis.com</google-fonts>
+                    <maxcdn>maxcdn.bootstrapcdn.com</maxcdn>
+                </style-src>
+                <img-src>
+                    <ga-img>www.google-analytics.com</ga-img>
+                    <doubleclick-img>stats.g.doubleclick.net</doubleclick-img>
+                    <paypal-img>www.paypal.com</paypal-img>
+                    <paypal-objects-img>www.paypalobjects.com</paypal-objects-img>
+                    <facebook-img>connect.facebook.net</facebook-img>
+                </img-src>
+                <connect-src>
+                    <ga-connect>www.google-analytics.com</ga-connect>
+                    <paypal-connect>www.paypal.com</paypal-connect>
+                    <paypal-secure>securepayments.paypal.com</paypal-secure>
+                    <braintree>api.braintreegateway.com</braintree>
+                    <stripe-js>js.stripe.com</stripe-js>
+                    <stripe-api>api.stripe.com</stripe-api>
+                </connect-src>
+                <font-src>
+                    <gstatic>fonts.gstatic.com</gstatic>
+                    <maxcdn-font>maxcdn.bootstrapcdn.com</maxcdn-font>
+                </font-src>
+                <frame-src>
+                    <paypal-frame>www.paypal.com</paypal-frame>
+                    <amazon>payments.amazon.com</amazon>
+                </frame-src>
+                <form-action>
+                    <paypal-form>www.paypal.com</paypal-form>
+                    <paypal-secure-form>securepayments.paypal.com</paypal-secure-form>
+                </form-action>
+            </frontend>
+            <adminhtml>
+                <report_only>1</report_only>
+                <split_headers>0</split_headers>
+                <merge_meta>1</merge_meta>
+            </adminhtml>
+        </csp>
+    </default>
+</config>
+
diff --git a/app/code/core/Mage/Csp/etc/system.xml b/app/code/core/Mage/Csp/etc/system.xml
new file mode 100644
index 00000000000..4b6b0166d62
--- /dev/null
+++ b/app/code/core/Mage/Csp/etc/system.xml
@@ -0,0 +1,363 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * @copyright  For copyright and license information, read the COPYING.txt file.
+ * @link       /COPYING.txt
+ * @license    Academic Free License (AFL 3.0)
+ * @package    Mage_Csp
+ */
+-->
+<config>
+    <sections>
+        <csp translate="label" module="csp">
+            <label>CSP protection</label>
+            <tab>advanced</tab>
+            <sort_order>300</sort_order>
+            <show_in_default>1</show_in_default>
+            <show_in_website>1</show_in_website>
+            <show_in_store>1</show_in_store>
+            <groups>
+                <frontend translate="label">
+                    <label>CSP protection Frontend</label>
+                    <sort_order>100</sort_order>
+                    <show_in_default>1</show_in_default>
+                    <show_in_website>1</show_in_website>
+                    <show_in_store>1</show_in_store>
+                    <fields>
+                        <enabled translate="label">
+                            <label>Enabled</label>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>10</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                        </enabled>
+                        <report_only translate="label">
+                            <label>Report Only</label>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>11</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </report_only>
+                        <report_uri translate="label">
+                            <label>Report URI</label>
+                            <frontend_type>text</frontend_type>
+                            <sort_order>12</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                        </report_uri>
+                        <split_headers translate="label">
+                            <label>Split Headers</label>
+                            <comment><![CDATA[Split headers for each directive]]></comment>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>13</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </split_headers>
+                        <merge_meta translate="label">
+                            <label>Convert meta CSP to HTTP headers</label>
+                            <comment><![CDATA[When enabled, CSP directives defined as meta tags in layout updates will be merged into HTTP response headers.]]></comment>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>14</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </merge_meta>
+                        <default-src translate="label">
+                            <label>default-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>20</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </default-src>
+                        <script-src translate="label">
+                            <label>script-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>21</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </script-src>
+                        <style-src translate="label">
+                            <label>style-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>22</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </style-src>
+                        <img-src translate="label">
+                            <label>img-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>23</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </img-src>
+                        <connect-src translate="label">
+                            <label>connect-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>24</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </connect-src>
+                        <font-src translate="label">
+                            <label>font-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>25</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </font-src>
+                        <frame-src translate="label">
+                            <label>frame-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>26</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </frame-src>
+                        <object-src translate="label">
+                            <label>object-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>27</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </object-src>
+                        <media-src translate="label">
+                            <label>media-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>28</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </media-src>
+                        <form-action translate="label">
+                            <label>form-action</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>29</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </form-action>
+                    </fields>
+                </frontend>
+                <adminhtml translate="label">
+                    <label>CSP protection Admin</label>
+                    <sort_order>200</sort_order>
+                    <show_in_default>1</show_in_default>
+                    <fields>
+                        <enabled translate="label">
+                            <label>Enabled</label>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>10</sort_order>
+                            <show_in_default>1</show_in_default>
+                        </enabled>
+                        <report_only translate="label">
+                            <label>Report Only</label>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>11</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </report_only>
+                        <report_uri translate="label">
+                            <label>Report URI</label>
+                            <frontend_type>text</frontend_type>
+                            <sort_order>12</sort_order>
+                            <show_in_default>1</show_in_default>
+                        </report_uri>
+                        <split_headers translate="label">
+                            <label>Split Headers</label>
+                            <comment><![CDATA[Split headers for each directive]]></comment>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>13</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </split_headers>
+                        <merge_meta translate="label">
+                            <label>Convert meta CSP to HTTP headers</label>
+                            <comment><![CDATA[When enabled, CSP directives defined as meta tags in layout updates will be merged into HTTP response headers.]]></comment>
+                            <frontend_type>select</frontend_type>
+                            <source_model>adminhtml/system_config_source_yesno</source_model>
+                            <sort_order>14</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <show_in_website>1</show_in_website>
+                            <show_in_store>1</show_in_store>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </merge_meta>
+                        <default-src translate="label">
+                            <label>default-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>20</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </default-src>
+                        <script-src translate="label">
+                            <label>script-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>21</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </script-src>
+                        <style-src translate="label">
+                            <label>style-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>22</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </style-src>
+                        <img-src translate="label">
+                            <label>img-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>23</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </img-src>
+                        <connect-src translate="label">
+                            <label>connect-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>24</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </connect-src>
+                        <font-src translate="label">
+                            <label>font-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>25</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </font-src>
+                        <frame-src translate="label">
+                            <label>frame-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>26</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </frame-src>
+                        <object-src translate="label">
+                            <label>object-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>27</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </object-src>
+                        <media-src translate="label">
+                            <label>media-src</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>28</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </media-src>
+                        <form-action translate="label">
+                            <label>form-action</label>
+                            <frontend_model>adminhtml/system_config_form_field_csp_hosts</frontend_model>
+                            <backend_model>adminhtml/system_config_backend_serialized_array</backend_model>
+                            <sort_order>29</sort_order>
+                            <show_in_default>1</show_in_default>
+                            <depends>
+                                <enabled>1</enabled>
+                            </depends>
+                        </form-action>
+                    </fields>
+                </adminhtml>
+            </groups>
+        </csp>
+    </sections>
+</config>
diff --git a/app/design/adminhtml/default/default/layout/csp.xml b/app/design/adminhtml/default/default/layout/csp.xml
new file mode 100644
index 00000000000..01191075087
--- /dev/null
+++ b/app/design/adminhtml/default/default/layout/csp.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * OpenMage
+ *
+ * This source file is subject to the Academic Free License (AFL 3.0)
+ * that is bundled with this package in the file LICENSE_AFL.txt.
+ * It is also available at https://opensource.org/license/afl-3-0-php
+ *
+ * @category    design
+ * @package     base_default
+ * @copyright   Copyright (c) 2025 The OpenMage Contributors (https://www.openmage.org)
+ * @license     https://opensource.org/licenses/afl-3.0.php  Academic Free License (AFL 3.0)
+ */
+-->
+<layout version="0.1.0">
+    <default>
+        <reference name="head">
+            <block type="csp/adminhtml_meta" name="csp_meta" after="-" />
+        </reference>
+    </default>
+</layout>
diff --git a/app/design/adminhtml/default/default/template/system/config/form/field/csp.phtml b/app/design/adminhtml/default/default/template/system/config/form/field/csp.phtml
new file mode 100644
index 00000000000..a7979c2737f
--- /dev/null
+++ b/app/design/adminhtml/default/default/template/system/config/form/field/csp.phtml
@@ -0,0 +1,187 @@
+<?php
+/**
+ * OpenMage
+ *
+ * This source file is subject to the Academic Free License (AFL 3.0)
+ * that is bundled with this package in the file LICENSE_AFL.txt.
+ * It is also available at https://opensource.org/license/afl-3-0-php
+ *
+ * @category    design
+ * @package     default_default
+ * @copyright   Copyright (c) 2006-2020 Magento, Inc. (https://www.magento.com)
+ * @copyright   Copyright (c) 2021-2025 The OpenMage Contributors (https://www.openmage.org)
+ * @license     https://opensource.org/licenses/afl-3.0.php  Academic Free License (AFL 3.0)
+ */
+
+/**
+ * @see Mage_Adminhtml_Block_System_Config_Form_Field_Csp_Hosts
+ * @var Mage_Adminhtml_Block_System_Config_Form_Field_Csp_Hosts $this
+ */
+?>
+<?php
+$_htmlId = $this->getHtmlId() ? $this->getHtmlId() : '_' . uniqid();
+
+$_colspan = 2;
+if (!$this->_addAfter) {
+    $_colspan -= 1;
+}
+$_colspan = $_colspan > 1 ? 'colspan="' . $_colspan . '"' : '';
+?>
+
+<div class="grid" id="grid<?php echo $_htmlId ?>">
+    <table cellpadding="0" cellspacing="0" class="border">
+        <tbody>
+
+            <tr class="headings" id="headings<?php echo $_htmlId ?>">
+<?php foreach ($this->_columns as $columnName => $column):?>
+                <th><?php echo $column['label'] ?></th>
+<?php endforeach ?>
+                <th <?php echo $_colspan?>></th>
+            </tr>
+
+            <tr id="addRow<?php echo $_htmlId ?>">
+                <td colspan="<?php echo count($this->_columns) ?>"></td>
+                <td <?php echo $_colspan?>>
+                    <button style="" onclick="" class="scalable add" type="button" id="addToEndBtn<?php echo $_htmlId ?>">
+                        <span><span><span><?php echo $this->_addButtonLabel ?></span></span></span>
+                    </button>
+                </td>
+            </tr>
+
+        </tbody>
+    </table>
+    <input type="hidden" name="<?php echo $this->getElement()->getName() ?>[__empty]" value="" />
+</div>
+<div id="empty<?php echo $_htmlId ?>">
+    <button style="" onclick="" class="scalable add" type="button" id="emptyAddBtn<?php echo $_htmlId ?>">
+        <span><span><span><?php echo $this->_addButtonLabel ?></span></span></span>
+    </button>
+</div>
+
+<script type="text/javascript">
+//<![CDATA[
+// create row creator
+var arrayRow<?php echo $_htmlId ?> = {
+    // define row prototypeJS template
+    template : new Template(
+        '<tr id="#{_id}">'
+<?php foreach ($this->_columns as $columnName => $column):?>
+            +'<td>'
+                +'<?php echo Mage::helper('core')->jsQuoteEscape($this->_renderCellTemplate($columnName)) ?>'
+            +'<\/td>'
+<?php endforeach ?>
+<?php if ($this->_addAfter):?>
+            +'<td><button onclick="" class="scalable add" type="button" id="addAfterBtn#{_id}"><span><span><span><?php echo Mage::helper('core')->jsQuoteEscape(Mage::helper('adminhtml')->__('Add after')) ?><\/span><\/span><\/span><\/button><\/td>'
+<?php endif ?>
+            +'<td><button onclick="arrayRow<?php echo $_htmlId ?>.del(\'#{_id}\')" class="scalable delete" type="button"><span><span><span><?php echo Mage::helper('core')->jsQuoteEscape(Mage::helper('adminhtml')->__('Delete')) ?><\/span><\/span><\/span><\/button><\/td>'
+        +'<\/tr>'
+    ),
+    templateReadonly : new Template(
+        '<tr id="#{_id}">'
+<?php foreach ($this->_columns as $columnName => $column):?>
+            +'<td>'
+                +'<?php echo Mage::helper('core')->jsQuoteEscape($this->_renderCellTemplate($columnName)) ?>'
+            +'<\/td>'
+<?php endforeach ?>
+<?php if ($this->_addAfter):?>
+            +'<td><button onclick="" class="scalable add" type="button" id="addAfterBtn#{_id}"><span><span><span><?php echo Mage::helper('core')->jsQuoteEscape(Mage::helper('adminhtml')->__('Add after')) ?><\/span><\/span><\/span><\/button><\/td>'
+<?php endif ?>
+            +'<td style="vertical-align: middle;" class="scope-label">&lt;#{area}/&gt;<\/td>'
+        +'<\/tr>'
+    ),
+
+    rowsCount : 0,
+
+    add : function(templateData, insertAfterId)
+    {
+        // generate default template data
+        if ('' == templateData) {
+            var d = new Date();
+            var templateData = {
+<?php foreach ($this->_columns as $columnName => $column):?>
+                <?php echo $columnName ?> : '',
+<?php endforeach ?>
+                _id : '_' + d.getTime() + '_' + d.getMilliseconds()
+            };
+        }
+
+        if (templateData.readonly) {
+            var _newRow = this.templateReadonly.evaluate(templateData);
+        } else {
+            var _newRow = this.template.evaluate(templateData);
+        }
+
+        // insert before last row
+        if ('' == insertAfterId) {
+            Element.insert($('addRow<?php echo $_htmlId ?>'), {before: _newRow});
+        }
+        // insert after specified row
+        else {
+            Element.insert($(insertAfterId), {after: _newRow});
+        }
+        // workaround for prototypeJS bug with disabled inputs
+        if (templateData.readonly) {
+            requestAnimationFrame(function() {
+                var input = document.getElementById(templateData._id).getElementsByTagName('input')[0];
+                if (input) {
+                    input.setAttribute('disabled', 'disabled');
+                    input.setAttribute('aria-disabled', 'true');
+                    input.setAttribute('aria-readonly', 'true');
+                }
+            });
+    }
+
+<?php if ($this->_addAfter):?>
+        Event.observe('addAfterBtn' + templateData._id, 'click', this.add.bind(this, '', templateData._id));
+<?php endif ?>
+
+        this.rowsCount += 1;
+    },
+
+    del : function(rowId)
+    {
+        $(rowId).remove();
+        this.rowsCount -= 1;
+        if (0 == this.rowsCount) {
+            this.showButtonOnly();
+        }
+    },
+
+    showButtonOnly : function()
+    {
+        $('grid<?php echo $_htmlId ?>').hide();
+        $('empty<?php echo $_htmlId ?>').show();
+    }
+}
+
+// bind add action to "Add" button in last row
+Event.observe('addToEndBtn<?php echo $_htmlId ?>', 'click', arrayRow<?php echo $_htmlId ?>.add.bind(arrayRow<?php echo $_htmlId ?>, '', ''));
+
+// add existing rows
+<?php
+$_addAfterId = "headings{$_htmlId}";
+foreach ($this->getArrayRows() as $_rowId => $_row) {
+    echo "arrayRow{$_htmlId}.add(" . $_row->toJson() . ", '{$_addAfterId}');\n";
+    $_addAfterId = $_rowId;
+}
+?>
+
+// initialize standalone button
+$('empty<?php echo $_htmlId ?>').hide();
+Event.observe('emptyAddBtn<?php echo $_htmlId ?>', 'click', function () {
+    $('grid<?php echo $_htmlId ?>').show();
+    $('empty<?php echo $_htmlId ?>').hide();
+    arrayRow<?php echo $_htmlId ?>.add('', '');
+});
+
+// if no rows, hide grid and show button only
+<?php if (!$this->getArrayRows()):?>
+arrayRow<?php echo $_htmlId ?>.showButtonOnly();
+<?php endif ?>
+
+// toggle the grid, if element is disabled (depending on scope)
+<?php if ($this->getElement()->getDisabled()):?>
+toggleValueElements({checked:true}, $('grid<?php echo $_htmlId ?>').parentNode);
+<?php endif ?>
+//]]>
+</script>
diff --git a/app/design/frontend/base/default/layout/csp.xml b/app/design/frontend/base/default/layout/csp.xml
new file mode 100644
index 00000000000..50548ef4321
--- /dev/null
+++ b/app/design/frontend/base/default/layout/csp.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * OpenMage
+ *
+ * This source file is subject to the Academic Free License (AFL 3.0)
+ * that is bundled with this package in the file LICENSE_AFL.txt.
+ * It is also available at https://opensource.org/license/afl-3-0-php
+ *
+ * @category    design
+ * @package     base_default
+ * @copyright   Copyright (c) 2025 The OpenMage Contributors (https://www.openmage.org)
+ * @license     https://opensource.org/licenses/afl-3.0.php  Academic Free License (AFL 3.0)
+ */
+-->
+<layout version="0.1.0">
+    <default>
+        <reference name="head">
+            <block type="csp/meta" name="csp_meta" after="-" />
+        </reference>
+    </default>
+</layout>
diff --git a/app/etc/modules/Mage_Csp.xml b/app/etc/modules/Mage_Csp.xml
new file mode 100644
index 00000000000..156e16d2183
--- /dev/null
+++ b/app/etc/modules/Mage_Csp.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * OpenMage
+ *
+ * This source file is subject to the Academic Free License (AFL 3.0)
+ * that is bundled with this package in the file LICENSE_AFL.txt.
+ * It is also available at https://opensource.org/license/afl-3-0-php
+ *
+ * @category   Mage
+ * @package    Mage_Csp
+ * @copyright  Copyright (c) 2022 The OpenMage Contributors (https://www.openmage.org)
+ * @license    https://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0)
+ */
+-->
+<config>
+    <modules>
+        <Mage_Csp>
+            <active>true</active>
+            <codePool>core</codePool>
+            <depends>
+                <Mage_Core/>
+            </depends>
+        </Mage_Csp>
+    </modules>
+</config>