Glossary · Developer Concepts
Content Security Policy(CSP)
An HTTP response header that tells browsers which sources of script, style, image and other content the page may load.
Browse all definitionsIn detail
Content Security Policy (CSP) is a browser enforced allowlist that limits where a page can load executable content from. A strict CSP rejects inline scripts, blocks unknown CDNs and prevents many XSS techniques even when the underlying vulnerability is present. Developers can deploy CSP in Report-Only mode first to catch breakage before enforcement. Modern best practice is a strict, nonce based CSP, but a script-src allowlist is the pragmatic starting point for most production apps.
Apply the definition
Want to talk through how this applies to your business?
Start with the decision in front of you. We will help map the fit.
Straight answers · no pitch deck · no commitment