Content-Security-Policy (CSP)

Controls which sources the browser may load for scripts, styles, images, frames, and other content.

CSP reduces the impact of cross-site scripting by restricting where executable content can come from.

securityheadercspxss

Starter policy (http)

Content-Security-Policy: default-src 'self';
  script-src 'self';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  object-src 'none';
  frame-ancestors 'none';
  base-uri 'self'

CSP is an allowlist expressed through the Content-Security-Policy response header. Start with a report-only policy, review violations, then enforce the policy once legitimate sources are covered.

A strict nonce- or hash-based policy is usually safer than a broad host allowlist. Avoid unsafe-inline and unsafe-eval unless a specific legacy dependency requires them.

Common mistakes

Adding * to make a policy "work" and losing most of the protection.
Forgetting that inline scripts require a nonce or hash under a strict policy.
Testing only the homepage instead of the full application flow.

IANA registry: http-fields/field-names

Registry reference: Content Security Policy Level 3

Strict-Transport-Security (HSTS)X-Content-Type-Options Referrer-Policy

Sources

MDN Web Docs: HTTP