Content Security Policy (CSP)

Content Security Policy (CSP) is a browser security control delivered primarily through an HTTP response header. A site uses directives such as script-src, style-src, img-src, and connect-src to restrict where different resource types may come from and, for scripts, which code may run. A well-designed policy can reduce the impact of some cross-site scripting and content-injection attacks. It is an additional protective layer, not a substitute for input handling, output encoding, secure dependencies, or regular patching.

For a business website, CSP becomes especially relevant when analytics tags, embedded videos, chat tools, and third-party forms load content from other domains. A policy copied from another site may accidentally block legitimate functions or be so permissive that it offers little protection. Development teams should inventory required integrations, prefer appropriate nonces or hashes for scripts where feasible, and test key user journeys before enforcement.

MDN documents both enforced Content-Security-Policy headers and a Report-Only mode for observing violations without blocking requests. Reporting helps teams identify legitimate resources that need review, but a report is not proof that every security issue has been fixed. Implementing nonce-based CSP also has consequences for rendering and caching: a fresh, unpredictable nonce belongs to a response, so static pages may use other approaches such as script hashes. Evaluate compatibility with the actual hosting setup rather than promising that a single header guarantees security.