What Content Security Policy (CSP) means
A CSP limits the damage from XSS and compromised third-party scripts by blocking anything not on your approved list. It takes careful setup, since a strict policy can break legitimate tools. Starting in report-only mode helps you tune it safely.
Why it matters for your website
If an attacker manages to inject a script into your page, a strict CSP can stop the browser from running it or sending data to the attacker's server. That is valuable protection for forms and checkouts. Because a strict policy can also block your own tools, it needs careful setup.
Example
An online bakery sets a Content-Security-Policy that only allows scripts from its own domain and its payment and analytics providers. An injected script from an unknown domain gets blocked.
Tips
- Start in report-only mode to see what would be blocked before enforcing.
- List every third-party script and service your site really needs.
- Review the policy whenever you add a new marketing or chat tool.
Common mistakes
- Allowing 'unsafe-inline' and wildcard sources, which removes most of the protection.
- Turning on a strict policy without testing and breaking forms or analytics.
Questions about Content Security Policy (CSP)
What is Content Security Policy (CSP)?
A security header that tells browsers which sources of scripts, styles and other content a page may load.
How do I add a Content Security Policy to my website?
It is usually set as an HTTP response header through your server, host, CDN or a security plugin. A meta tag can also work for some directives.
Will a CSP break Google Analytics or Tag Manager?
It can if those domains are not allowed. Google publishes guidance on which sources to allow, and testing in report-only mode helps you catch problems first.
