Content-Security-Policy (CSP)

What the Content-Security-Policy header does, why it's the highest-impact defense against XSS attacks, and a starter CSP policy you can deploy today.

What it is

Content-Security-Policy tells the browser exactly which sources are allowed to load scripts, styles, images, and other resources. It's the single most effective defense against cross-site scripting (XSS) — even if an attacker injects code, the browser refuses to run it.

Why it matters

XSS remains a top web vulnerability (CWE-79). CSP is defense-in-depth that works when input sanitization fails. Scanners flag its absence because it's the cheapest high-impact header you can add.

How to fix it

nginx

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;

Apache

Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"

Starter tip

Start with Content-Security-Policy-Report-Only to collect violations, then enforce.

See if your site passes

Check your CSP header free

FAQ

Will CSP break my site?

It can if you load scripts from CDNs or use inline scripts. Start in Report-Only mode, review violations, add the sources you trust, then enforce.

Is CSP enough to stop XSS?

No — it's defense in depth. Keep sanitizing input and encoding output. CSP catches what slips through.

More explainers: HSTS (HTTP Strict Transport Security) · DMARC (Domain-based Message Authentication) · Cookie Consent (GDPR/ePrivacy) · SPF (Sender Policy Framework) · DKIM (DomainKeys Identified Mail) · X-Frame-Options / frame-ancestors · llms.txt (AI Crawler Guidance) · all checks