Content-Security-Policy explained
Last updated · Reviewed by a CISSP-certified security practitioner
Content-Security-Policy: CSP is an allow-list for where your page may load scripts, styles, images, frames and connections from. It is the strongest defence against cross-site scripting. Recommended value: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests.
What risk does it prevent?
Without a CSP, any injected script (XSS, a compromised third‑party tag, a Magecart skimmer) runs with full access to your users' sessions and payment forms.
What is the safe recommended value?
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
What are the gotchas?
- Deploy as Content-Security-Policy-Report-Only first and watch reports before enforcing.
- 'unsafe-inline' and 'unsafe-eval' in script-src remove most of the XSS protection. Use nonces or hashes.
- Analytics, chat widgets and payment iframes need their hosts added explicitly.
- Only one CSP header should be sent; multiple policies are intersected, which often blocks more than expected.
Which compliance controls reference it?
- PCI DSS 4.0 6.4.3
- PCI DSS 4.0 11.6.1
- OWASP ASVS V14.4.3
- SOC 2 CC6.8
- NIST 800-171 3.13.1
How do I add it on my stack?
- Content-Security-Policy on Nginx
- Content-Security-Policy on Apache
- Content-Security-Policy on IIS
- Content-Security-Policy on Cloudflare
- Content-Security-Policy on Vercel
- Content-Security-Policy on Netlify
- Content-Security-Policy on AWS CloudFront
- Content-Security-Policy on Express / Node
- Content-Security-Policy on Next.js
- Content-Security-Policy on WordPress
- Content-Security-Policy on Lovable / static hosting
Check your site now
Free scan, instant grade, exact fixes for your stack.
Other security headers
- Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
- X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
- X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
- Referrer-Policy — Limits how much of your URLs leak to other sites.
- Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
- Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
- Cross-Origin-Resource-Policy — Stops other sites from loading your resources.
- Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).