What is Content Security Policy?
An HTTP header that restricts which resources a page may load, mitigating XSS and injection attacks.
Definition
CSP is a browser-enforced allowlist delivered via the `Content-Security-Policy` header, declaring which origins may supply scripts, styles, images, frames, and connections. Its primary value is defense in depth against cross-site scripting: even if an attacker injects a `<script>` tag, the browser refuses to execute it unless the source is permitted. Effective policies avoid `unsafe-inline` and `unsafe-eval`, using per-request nonces or content hashes to authorize legitimate inline scripts instead. Deploying CSP on an existing site is normally staged—run it in `Content-Security-Policy-Report-Only` mode first, collect violation reports at a `report-uri` endpoint, tighten until clean, then enforce. Directives like `frame-ancestors` also supersede the older `X-Frame-Options` header for clickjacking protection.