Glossary
Content Security Policy (CSP)
A Content Security Policy is an HTTP header that declares which sources a page may load scripts, styles and other resources from.
Updated 2 Sept 2026
In detail
CSP is the most effective single mitigation against injected third-party scripts: a script tag pointing at an origin the policy does not allow is blocked by the browser even though the injection itself succeeded. Modern policies are built around nonces or hashes for inline scripts plus strict-dynamic, rather than long allowlists of hostnames, because allowlists tend to include origins that can serve arbitrary code.
Why it matters
On a content site, CSP is what stops an injected analytics-lookalike script from exfiltrating form data. It also turns silent injections into visible signals: violation reports arrive as soon as blocked content is requested, which is often the first indication of a compromise.
Examples
- script-src 'nonce-r4nd0m' 'strict-dynamic' — only scripts carrying the per-response nonce execute.
- connect-src 'self' https://api.example.com — blocks exfiltration to an attacker-controlled endpoint.
- frame-ancestors 'none' — prevents the page being framed, replacing X-Frame-Options.