Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Syntax
Content-Security-Policy: <directive> <source>; <directive> <source>Example
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.comDescription
The Content-Security-Policy (CSP) header is one of the most powerful security mechanisms available to web developers. It defines an allowlist of content sources that the browser should trust, effectively mitigating cross-site scripting (XSS) and other code injection attacks.
CSP works by specifying directives that control resource loading: default-src sets the fallback policy, script-src controls JavaScript sources, style-src manages CSS, and img-src handles images. Each directive can specify origins, keywords like \'self\' or \'unsafe-inline\', and nonce/hash-based whitelisting.
Implementing CSP correctly requires careful planning. Start with Content-Security-Policy-Report-Only to monitor violations without blocking, then gradually tighten the policy.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
36.8%
(185 of 503) send Content-Security-Policy.
See it on: yandex.ru, discord.com, github.com, cloudflare.com, beget.com
State of Web Security, November 2026: of 5,501 HTTPS home pages in the report,
- 35.1% enforce a CSP
- 4.1% only in Report-Only mode
Check if your website sends this header correctly
Check your headers →