What is a Content-Security-Policy header?

A Content-Security-Policy (CSP) is an HTTP response header that tells the browser which sources a page may load scripts, styles, images and other resources from. Anything outside the list is blocked. Its main purpose is to limit the damage of cross-site scripting, where an attacker manages to inject unwanted code into a page.

Why it matters

If an attacker injects a script into your page, the browser would normally run it. A policy that allows scripts only from your own domain makes the browser refuse the injected one. CSP is an extra layer of protection. It does not replace careful coding, such as escaping user input.

How to roll one out

List where your pages load resources from: your own domain, a CDN, analytics, fonts, embedded video.
Start in report-only mode, which logs violations without blocking anything:

Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' https:; script-src 'self' https://analytics.example.net

Open your site in a browser with the Console open and read the violation messages. Each one names a blocked source and the directive involved.
Add the sources you trust, and remove inline scripts where you can, or allow them using a nonce or hash rather than 'unsafe-inline'.
When the reports go quiet across your main pages, switch the header name to Content-Security-Policy.
Keep reviewing it. Adding a new tool or embed will need a policy update.

Some common directives:

default-src is the fallback for any resource type not set elsewhere.
script-src controls JavaScript sources.
style-src controls style sources.
img-src controls images.
frame-ancestors controls who may embed your page in a frame.
upgrade-insecure-requests asks the browser to fetch insecure addresses over HTTPS.

The header is set at the web server, CDN or application, not in the page content. A meta tag version exists but supports fewer directives.

Common mistakes

Switching on enforcement straight away and breaking the site.
Allowing 'unsafe-inline' and * everywhere, which defeats the purpose.
Forgetting third-party services such as fonts, maps or payment forms.
Testing only the home page.
Treating CSP as a complete security solution.

Crawvix's scan checks that a Content-Security-Policy header is set.

Frequently asked questions

Does CSP affect SEO?

It is not a ranking factor. A policy that blocks your own scripts or styles can break the page, which may harm how it looks and works.

What is report-only mode?

It uses the header Content-Security-Policy-Report-Only. The browser reports violations but still loads everything, so you can test safely.

Do I need a CSP on a small brochure site?

It is optional but sensible. A simple policy is a low-cost way to reduce what injected code can do.

To see which security headers your site sends, Try the free website sample.