What is Content Security Policy?
An HTTP response header that whitelists exactly which origins may supply scripts, styles, and frames. A tight policy neuters injected payloads even after an XSS bug ships.
Example
A BYOB marketing site allows scripts from its own origin plus one analytics domain and blocks everything else. When a third-party widget injects an inline snippet, browsers refuse it and file a violation report instead of running unknown code.
What people get wrong
Deploying report-only mode forever and calling the job done. Reports without enforcement train nobody; graduate tested policies to blocking once the noise settles.
Related terms
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.
Cross-Site Scripting (XSS)
An injection flaw where attacker-supplied scripts execute in a victim’s browser, stealing sessions or defacing pages. Output-encoding, framework auto-escaping, and strong CSP turn most payloads inert.
Clickjacking & X-Frame-Options
A UI-redress attack that layers an invisible frame over a legitimate page to hijack clicks. The frame-ancestors CSP directive or X-Frame-Options DENY keeps sensitive pages unframeable.
Mixed Content
HTTP resources loaded on an HTTPS page. Browsers block or warn on them, breaking assets and trust signals, so audits must catch a single insecure canonical, script, or image.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.