Glossary · Security

CSP Nonce

A CSP nonce is a random, single-use token that marks specific inline scripts or styles as allowed under a Content Security Policy.

Updated November 11, 2026

A CSP nonce is a random value, generated fresh for every response, that appears both in the Content-Security-Policy header and as a nonce attribute on the inline <script> or <style> tags you trust. The browser runs only the inline code whose nonce matches.

Why it matters

A strict policy blocks inline scripts, which breaks many sites that need a few. Allowing 'unsafe-inline' fixes that but also lets injected scripts run, defeating much of the protection against cross-site scripting. A nonce allows your own inline blocks while an attacker who injects markup cannot guess the current value.

The nonce must be unpredictable and unique per response. A static value baked into a template offers no protection, and cached HTML with a fixed nonce breaks the scheme.

Example

Content-Security-Policy: script-src 'nonce-r4nd0mBase64Value' 'strict-dynamic'; object-src 'none'; base-uri 'none'
<script nonce="r4nd0mBase64Value">initApp();</script>

Generate at least 128 bits of randomness on the server for each request. With 'strict-dynamic', scripts loaded by a trusted script inherit trust.

Common mistakes

  • Reusing one nonce across requests or caching pages that contain it.
  • Putting the nonce on tags that include user-controlled content.
  • Keeping 'unsafe-inline' as a fallback in a way that silently cancels the benefit in older browsers.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCSP (Content Security Policy)Content Security Policy is an HTTP header that lists which sources a page may load scripts, styles and other resources from, limiting the damage of XSS attacks.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · SSL & SecurityMixed Content Warnings: How to Find and Fix HTTP Resources on HTTPSUnderstand active vs passive mixed content, hunt down http:// references in HTML, CSS, JS and databases, fix them with wp-cli or CSP, and verify the result.8 min readGlossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityCORS (Cross-Origin Resource Sharing)CORS is a browser mechanism that uses HTTP headers to let a server permit specific other origins to read its responses, relaxing the same-origin policy.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.