Security
CSP
Content Security Policy
Content Security Policy (CSP) is an HTTP response header that restricts which sources a browser may load scripts, styles, images, and other resources from. It is the primary defence against cross-site scripting (XSS) attacks.
Part of Security header monitoring — the full answer, the facts and the alternatives in one place.
In depth
A CSP is a series of directives like `script-src 'self' https://js.stripe.com` that whitelist allowed origins. Anything not on the list is blocked by the browser, even if injected by a successful XSS attack.
Writing a strict CSP is hard — third-party scripts, inline event handlers, and `eval()` all need explicit allowances. Most sites ship a `report-only` CSP first to find unexpected blocks before enforcing.
Why it matters
A well-tuned CSP eliminates entire classes of XSS attacks at the browser level, regardless of upstream code bugs. It is one of the highest-ROI security controls available — and one of the easiest to break accidentally during refactors, which is why monitoring header presence and value matters.
How Lemwatch helps with csp
Lemwatch monitors csp continuously and alerts you the moment something changes.
Security headers →Related terms
Security Headers
Security headers are HTTP response headers that instruct browsers to enforce additional defences against commo…
HSTS
HTTP Strict Transport Security (HSTS) is an HTTP response header that tells browsers to access the site only o…
SSL/TLS
SSL/TLS is the cryptographic protocol that secures HTTPS connections. It encrypts traffic between browser and …
DKIM
DomainKeys Identified Mail (DKIM) is an email authentication standard that adds a cryptographic signature to e…
DMARC
DMARC is an email authentication protocol that lets a domain owner publish a policy specifying how mailbox pro…
Browse the full Lemwatch monitoring glossary (47 terms).