CSP (Content Security Policy)

Content Security Policy (CSP) is an HTTP response header, Content-Security-Policy, that tells the browser which origins are allowed to supply scripts, styles, images, frames and other resources. Anything outside the policy is blocked, which makes cross-site scripting (XSS) much harder to exploit.

Why it matters

If an attacker injects a <script> tag into your page, a strict CSP stops the browser from running it. It also helps you notice unexpected third-party scripts on your site.

Example

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; img-src 'self' data:; frame-ancestors 'none'; report-to csp

Here everything defaults to your own origin, scripts may also load from one CDN, and no site may frame your pages. To test without breaking anything, send Content-Security-Policy-Report-Only first and review the violation reports.

Common mistakes

• Using 'unsafe-inline' in script-src, which cancels most of the protection. Prefer nonces or hashes.
• Deploying an enforcing policy without a report-only trial, which silently breaks analytics, fonts or payment widgets.
• Whitelisting a broad host such as https://*.googleapis.com that can serve attacker-controlled content.
• Forgetting that frame-ancestors is the CSP way to stop clickjacking; it is not covered by default-src.

Related

• HSTS
• CORS
• WAF
• Guide: Content Security Policy guide
• Tool: Security headers checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.