Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Syntax
Content-Security-Policy: <directive> <source>; <directive> <source>Example
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.comDescription
The Content-Security-Policy (CSP) header is one of the most powerful security mechanisms available to web developers. It defines an allowlist of content sources that the browser should trust, effectively mitigating cross-site scripting (XSS) and other code injection attacks.
CSP works by specifying directives that control resource loading: default-src sets the fallback policy, script-src controls JavaScript sources, style-src manages CSS, and img-src handles images. Each directive can specify origins, keywords like \'self\' or \'unsafe-inline\', and nonce/hash-based whitelisting.
Implementing CSP correctly requires careful planning. Start with Content-Security-Policy-Report-Only to monitor violations without blocking, then gradually tighten the policy.
Check if your website sends this header correctly
Check your headers →