What a Content-Security-Policy does
A Content-Security-Policy (CSP) is a response header that tells the browser which places a page may load scripts, styles, images and frames from. If an attacker manages to inject a script, a good policy stops the browser from running it.
It is one of the strongest defences against cross-site scripting, and it also limits damage from compromised third-party scripts.
How to roll one out safely
Start in report-only mode so nothing breaks, open your site with the browser console open, and add every legitimate source that shows up as a violation. Once the console is quiet, switch to enforcing mode.
Avoid unsafe-inline and unsafe-eval in script sources. Use a nonce or hash for the inline scripts you cannot move to files.
Frequently asked questions
Will a Content-Security-Policy break my website?
It can, if the policy blocks something your pages need, such as an analytics script or a font. That is why report-only mode exists: it shows what would be blocked without blocking it.
Should I use the header or the meta tag?
Use the header when you can. A meta tag works for most directives but cannot set frame-ancestors or send reports, and it only applies after the browser has read it.
How do I check that the policy is live?
Open the security headers checker on your address, or use the HTTP header viewer, and look for Content-Security-Policy in the response.
Read-only: we request public pages the way a visitor would. Private and internal addresses are blocked, and nothing you enter is stored.
Want this running on every page, every day?
UrKavach monitors security, uptime, speed and SEO for every website you manage.