What CSP does
Content Security Policy tells the browser which scripts, styles, images, frames, connections, and other resources are allowed. A thoughtful CSP can reduce the impact of injection bugs and accidental third-party loading.
How to start safely
- List the resources your site actually needs.
- Start with a report-only policy when possible.
- Test login, forms, analytics, payments, and embedded widgets.
- Prefer specific hostnames instead of broad wildcards.
- Review violations before enforcing strict rules.
Common mistakes
Copying a strict policy from another site can break your own application. Browser apps, real-time connections, CAPTCHA widgets, and analytics often need explicit entries.
FAQ
Does CSP fix unsafe code?
No. It is a defensive layer. You still need input validation, output encoding, and secure development practices.
Should unsafe-inline always be removed?
It is a good long-term goal, but some frameworks or legacy pages may need a staged migration.