---
title: "CSP (Content Security Policy) — monitoring glossary"
description: "Content Security Policy (CSP) is an HTTP response header that restricts which sources a browser may load scripts, styles, images, and other resources from.…"
canonical: "https://lemwatch.com/glossary/csp"
source: "https://lemwatch.com"
---

# CSP (Content Security Policy)

> Content Security Policy (CSP) is an HTTP response header that restricts which sources a browser may load scripts, styles, images, and other resources from. It is the primary defence against cross-site scripting (XSS) attacks.

## Definition

 A CSP is a series of directives like `script-src 'self' https://js.stripe.com` that whitelist allowed origins. Anything not on the list is blocked by the browser, even if injected by a successful XSS attack.

 Writing a strict CSP is hard — third-party scripts, inline event handlers, and `eval()` all need explicit allowances. Most sites ship a `report-only` CSP first to find unexpected blocks before enforcing.

## Why it matters

 A well-tuned CSP eliminates entire classes of XSS attacks at the browser level, regardless of upstream code bugs. It is one of the highest-ROI security controls available — and one of the easiest to break accidentally during refactors, which is why monitoring header presence and value matters.

 See it in the product: [Security headers](https://lemwatch.com/features).


## Related

- [Monitoring glossary](https://lemwatch.com/glossary)
- [Security Headers](https://lemwatch.com/glossary/security-headers)
- [HSTS](https://lemwatch.com/glossary/hsts)
- [SSL/TLS](https://lemwatch.com/glossary/ssl)
- [All monitoring checks](https://lemwatch.com/features)
- [DKIM (DomainKeys Identified Mail)](https://lemwatch.com/glossary/dkim)
- [Core Web Vitals (CWV)](https://lemwatch.com/glossary/core-web-vitals)