What is Content Security Policy (CSP)?

A Content Security Policy is an HTTP response header that tells the browser which sources a page may load scripts, styles, images and frames from, limiting the damage of cross-site scripting.

A CSP is a list of directives such as default-src, script-src, img-src and frame-ancestors, each naming the origins allowed for that kind of resource. If an attacker injects a script tag pointing anywhere else, the browser refuses to run it.

Weak policies allow 'unsafe-inline' or 'unsafe-eval' in script-src, or any host via * or https:. Safe rollout uses the Content-Security-Policy-Report-Only header first to find legitimate sources before enforcing. The free ZetsApp Website Security Audit grades a site's CSP.