What is Content-Security-Policy (CSP)?
Content-Security-Policy is an HTTP header that tells browsers which sources of scripts, styles, images and frames your pages are allowed to use.
Why businesses care
It limits the damage of cross-site scripting by stopping unapproved scripts from running, even if an attacker manages to inject one.
Example
Content-Security-Policy: default-src 'self'; img-src 'self' https:How to check
Inspect response headers in your browser’s developer tools, or run the security headers checker.
How to fix
Start with Content-Security-Policy-Report-Only, list the sources your site really uses, then enforce.
Common mistakes
- Using 'unsafe-inline' everywhere
- Enforcing before testing, which breaks the site
- Forgetting third-party widgets such as chat or analytics
Sources
Check it with Security Headers Checker
Check your site’s HTTP security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and get values to add.
Open Security Headers Checker