Security · Response header
Content-Security-Policy
The primary defense against XSS: whitelist trusted sources.
What is Content-Security-Policy?
CSP tells the browser which sources of scripts, styles, images, and other resources are allowed. A tight CSP can neutralize most XSS attacks even if an injection happens.
Typical usage
Set on all HTML responses for user-facing web apps.
Examples
Strict CSP
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'Common gotchas
Introducing CSP breaks inline scripts and styles unless nonces or hashes are used. Roll it out in report-only mode first, then enforce.
Also known as
Also commonly written as: csp header · csp · content-security-policy header · csp nonce · csp script-src · csp default-src · csp unsafe-inline · csp strict-dynamic · CSP ヘッダ. These variants — including plural forms, unhyphenated spellings, and Japanese (ヘッダ) — all refer to the same Content-Security-Policy HTTP header.
Specification
W3C CSP Level 3
Frequently asked questions
What is the Content-Security-Policy HTTP header?
CSP tells the browser which sources of scripts, styles, images, and other resources are allowed. A tight CSP can neutralize most XSS attacks even if an injection happens.
Is Content-Security-Policy a request or response header?
Content-Security-Policy is a response header — the server sends it to the client. Set on all HTML responses for user-facing web apps.
What does a Content-Security-Policy header look like?
A typical Content-Security-Policy header looks like: Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none' (Strict CSP).
What are common mistakes with Content-Security-Policy?
Introducing CSP breaks inline scripts and styles unless nonces or hashes are used. Roll it out in report-only mode first, then enforce.
Related headers
Strict-Transport-Security
Force browsers to use HTTPS for a domain (HSTS).
X-Frame-Options
Prevents clickjacking by controlling framing.
X-Content-Type-Options
Disables MIME-type sniffing.
Referrer-Policy
Controls the Referer header sent on outgoing links and requests.
Permissions-Policy
Controls which browser features and APIs pages can use.