CSP (Content Security Policy)
Sitecheck Team
A security header that controls which resources a page is allowed to load.
Content Security Policy (CSP) is an HTTP response header that tells the browser which content sources (scripts, styles, images, etc.) are trusted and permitted to load on a page. It is one of the most effective defences against XSS.
Why it matters: A strict CSP prevents injected scripts from executing, significantly reducing the blast radius of XSS attacks and data injection.
Quick tips:
- Start with
Content-Security-Policy-Report-Onlyto audit before enforcing. - Use nonces or hashes for inline scripts rather than
'unsafe-inline'. - Keep the policy as restrictive as possible and audit third-party sources regularly.
See also: XSS, HTTPS, clickjacking.