What is a Content Security Policy (CSP)?
Short answer
A Content Security Policy is an HTTP header that tells the browser which sources of scripts, styles, images and frames a page may load. A well-built CSP greatly reduces the impact of cross-site scripting by blocking scripts the site did not approve.
The details
Start with Content-Security-Policy-Report-Only to see what would break, then tighten the policy. Nonce- or hash-based policies are stronger than long allowlists of domains.
Useful next reads and tools
- Security Header Analyzer · tool
Terms explained
- Content Security Policy
- Content Security Policy (CSP) is an HTTP response header that tells the browser which sources a page may load scripts, styles, images and frames from.
Sources
Related questions
- What are SPF, DKIM and DMARC?
- How do I stop someone from spoofing my email domain?
- How do I read email headers to check if a message is fake?
- What are HTTP security headers and which ones should my website have?
- How can I check if my website is secure?
- What is a DDoS attack and how do I protect a website from one?
Related Guides
GuideWeb Security
A Practical Guide to HTTP Security Headers for Web Developers
Why modern web applications need CSP, HSTS, and X-Content-Type-Options, and how to configure them properly in Next.js and Nginx.
Read more GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideWeb Security
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): How to Patch, Mitigate and Detect Attacks
Two critical PHP flaws allow unauthenticated remote code execution. See who is affected, the fixed versions, temporary mitigations and what to watch for in your logs.
Read more