Content-Security-Policy (CSP)
Restricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
default-src 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';Production Server Implementation
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;Directives & Syntax Breakdown
Fallback source for all unspecified fetch directives. Restricts resources to origin.
Restricts executable JavaScript sources to same-origin. Blocks unauthorized external scripts.
Disables Flash, Java applets, and other outdated plugins that carry severe vulnerabilities.
Modern CSP replacement for X-Frame-Options DENY to prevent clickjacking.
Restricts allowed URLs in the document <base> element to avoid base tag hijacking.
Common Security Hazards & Pitfalls
- •Avoid using 'unsafe-eval' or 'unsafe-inline' without nonces or hashes as they neutralize XSS protection.
- •Test thoroughly using 'Content-Security-Policy-Report-Only' before enforcing to avoid breaking third-party analytics.
Content-Security-Policy (CSP) - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
X-Frame-Options only prevents clickjacking by restricting iframe embedding. CSP includes "frame-ancestors" for clickjacking and additionally guards against XSS, script injection, and unsafe plugin execution.
Related HTTP Headers
Browse All HeadersForces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.
Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.