Content Security Policy (CSP) is an HTTP response header that restricts which sources a browser may load scripts, styles, images, and other resources from. It is the primary defence against cross-site scripting (XSS) attacks.
A CSP is a series of directives like `script-src 'self' https://js.stripe.com` that whitelist allowed origins. Anything not on the list is blocked by the browser, even if injected by a successful XSS attack.
Writing a strict CSP is hard — third-party scripts, inline event handlers, and `eval()` all need explicit allowances. Most sites ship a `report-only` CSP first to find unexpected blocks before enforcing.
A well-tuned CSP eliminates entire classes of XSS attacks at the browser level, regardless of upstream code bugs. It is one of the highest-ROI security controls available — and one of the easiest to break accidentally during refactors, which is why monitoring header presence and value matters.
See it in the product: Security headers.