Web development and performance
What is Content Security Policy?
A Content Security Policy is an HTTP header telling the browser which sources it may load scripts, styles, images and other resources from. It is the most effective single defence against cross-site scripting, because it limits damage even when an injection succeeds.
Also called: CSP
What a reasonable baseline looks like
- default-src 'self' — nothing loads from anywhere else unless stated
- script-src limited to your own origin and any analytics you deliberately added
- frame-ancestors 'none' — nobody can frame your pages, which prevents clickjacking
- object-src 'none' — legacy plugin content has no legitimate use
- upgrade-insecure-requests, so no mixed content slips through
The practical difficulty
Inline scripts and styles break under a strict policy, which is why so many sites end up with 'unsafe-inline' and most of the benefit removed. Nonces or hashes are the correct answer; a site with no third-party scripts at all finds the whole problem much smaller.
How to deploy it without breaking things
Start with Content-Security-Policy-Report-Only, collect what would have been blocked, fix those, then switch to enforcing. Deploying a strict policy straight to production is how a site loses its checkout at 5pm on a Friday.
Where this is covered in depth
A definition can only go so far. Technical SEO, in the order the problems actually block you covers this properly — 4 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.