---
title: "Lock down risky DOM writes · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/trusted-types
updated: 2026-10-20
licence: "All rights reserved"
---

# Lock down risky DOM writes

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Require Trusted Types in the CSP, so scripts can't write raw HTML into the page. Send every remaining case through one small named policy.
- How: Add `require-trusted-types-for 'script'` and `trusted-types <name>` to the CSP. Remove `innerHTML` and similar calls. Send the few you need through one policy that checks its input. Script addresses, such as a service worker's, need a policy too.
- Check: With the header on, a browser test visits every page and uses its main features. The console shows no Trusted Types violations.

Example:

```http
Content-Security-Policy: require-trusted-types-for 'script'; trusted-types app
```

```js
const policy = trustedTypes.createPolicy('app', {
  createHTML: s => s.replace(/[<>&"']/g, c => `&#${c.charCodeAt(0)};`),
});
el.innerHTML = policy.createHTML(userText);
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/trusted-types`.

- Previous: [Send a hash of the body](https://agentwranglers.se/playbook/website/security/digest-fields)
- Next: [Drop the old XSS header](https://agentwranglers.se/playbook/website/security/x-xss-protection)
- [Security](https://agentwranglers.se/playbook/website/security)