What is a Content-Security-Policy?
CSP is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources are allowed to load. A good policy blocks injected malicious scripts, making cross-site scripting attacks much harder to exploit.
Common source values
'self'— only your own domain.'none'— block everything for that directive.https:— any HTTPS source.'unsafe-inline'— allow inline scripts/styles (avoid if possible).- A specific domain like
https://cdn.example.com.
How to deploy
- Build the policy above and add it as a
Content-Security-Policyresponse header on your server. - Test first with
Content-Security-Policy-Report-Onlyso nothing breaks while you tune it. - Watch the browser console for blocked resources and add trusted sources as needed.
Start strict (
default-src 'self') and loosen only what you must. Avoid 'unsafe-inline' for scripts — it defeats much of CSP's protection.