Cybersecurity glossary
What is content Security Policy?
Also known as: CSP
Definition
Content Security Policy (CSP) is an HTTP response header that tells the browser which sources a page may load scripts, styles, images and frames from.
Why it matters
A strict CSP limits the damage of cross-site scripting by refusing to run scripts the site did not approve. The frame-ancestors directive also controls which sites may embed the page, which helps prevent clickjacking.
Roll out with Content-Security-Policy-Report-Only first, then enforce once nothing legitimate is blocked.
Common questions about content Security Policy
See also
Sources
Related Guides
GuideWeb Security
A Practical Guide to HTTP Security Headers for Web Developers
Why modern web applications need CSP, HSTS, and X-Content-Type-Options, and how to configure them properly in Next.js and Nginx.
Read more GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideGRC
How to Run a Security Awareness Training Program That Changes Behaviour
Build a security awareness and training program that changes behaviour: role-based content, phishing simulations done fairly, policy acknowledgement, metrics that matter and reporting to leadership.
Read more GuideGRC
How to Create an Acceptable Use Policy for Employees
Learn how to create an acceptable use policy for employees. This step-by-step tutorial covers scope, permitted use, prohibited actions, and enforcement.
Read more