What is Content Security Policy?
A Content Security Policy (CSP) is an HTTP header that restricts which sources of scripts, styles, and other resources a page may load. A well-configured CSP is a strong defense against cross-site scripting (XSS).
Why Content Security Policy matters
Cross-site scripting works because a browser cannot tell a script the developer wrote from one an attacker injected through a comment field or a compromised third-party tag. A Content Security Policy is the allow-list that lets it tell: which origins may serve scripts, styles, images, fonts and frames, whether inline scripts run, where forms may post, and who may embed the page. A strict policy turns most injection bugs from a breach into a blocked request and a report.
The difficulty is that real sites depend on analytics, sign-in widgets, payment iframes and inline snippets, so a policy written blind breaks things. The safe route is to ship it as Content-Security-Policy-Report-Only with a report endpoint, watch what real traffic would have blocked for a while, then enforce. Nonces or hashes replace 'unsafe-inline' for scripts when you are ready.
Example
A report-only policy to learn from before enforcing:
Content-Security-Policy-Report-Only:
default-src 'self';
script-src 'self' https://www.googletagmanager.com;
img-src 'self' data: https:;
frame-ancestors 'none';
report-uri /api/csp-reportNothing is blocked yet; every violation is posted to your endpoint.
Common mistakes
- •Enforcing a policy on day one and breaking sign-in or checkout.
- •Allowing
*for scripts, which is no policy at all. - •Forgetting the report endpoint, so violations disappear silently.
How Webmatik checks it
The Content Security Policy (CSP) check looks for either the enforced or the report-only header on the audited pages, and the Clickjacking protection check accepts a <code>frame-ancestors</code> directive in place of X-Frame-Options.
Check your own site
Free Website Security Checker
HTTPS, HSTS, CSP and the other headers most sites are missing — with exactly what to add.
Related Security terms
See how your website scores across SEO, GEO, performance, and more
Run a free audit