What is Content Security Policy?
Also called: CSP
The short answer
A Content Security Policy is a response header that tells the browser which sources of scripts, styles, images and frames a page may load, blocking injected code.
Content Security Policy, explained
It is one of the strongest defences against cross-site scripting; it can also control which sites may embed yours (frame-ancestors).
Questions people ask about Content Security Policy
What is Content Security Policy?
A Content Security Policy is a response header that tells the browser which sources of scripts, styles, images and frames a page may load, blocking injected code.
Related terms
Cross-site scripting is an attack where malicious code is injected into a page and runs in other visitors' browsers, stealing sessions or data.
CORSCORS is the browser rule that controls whether a page on one domain may request data from another domain, enforced through response headers the server sends.
Website securityWebsite security is protecting a site, its data and its visitors from attacks, through HTTPS, updated software, careful input handling, strong logins and backups.
Cross-site request forgeryCross-site request forgery tricks a logged-in user's browser into sending an unwanted request, such as changing an email address, to a site they trust.
Part of the Web Encyclopedia by Apex Flow Digital. Definitions are general knowledge, kept current, with no invented statistics.