Content Security Policy (CSP)
Abbreviation: CSP
Pronunciation: KAHN-tehnt sih-KYOOR-ih-tee POL-ih-see (C-S-P)
Also known as: Content Security Policy, CSP
Definition
Content Security Policy is a browser-enforced policy that restricts which resources a web page may load, execute, embed, or connect to. Content Security Policy lets a website declare allowed sources and behaviors through HTTP headers or limited markup. Directives can control scripts, styles, images, frames, connections, form destinations, base URLs, and other browser actions relevant to content injection.
Overview
Meaning and scope
Content Security Policy is a browser-enforced policy that restricts which resources a web page may load, execute, embed, or connect to. Content Security Policy lets a website declare allowed sources and behaviors through HTTP headers or limited markup. Directives can control scripts, styles, images, frames, connections, form destinations, base URLs, and other browser actions relevant to content injection.
Mechanism and operation
A strong policy can reduce the impact of cross-site scripting and malicious content, especially when it avoids broad wildcards and unsafe inline execution. Teams should begin with reporting, inventory legitimate sources, use nonces or hashes where appropriate, remove unsafe allowances, and monitor violations. Policies require testing across pages and third-party integrations because an overly strict deployment can break essential functionality. An auditable record of Content Security Policy (CSP) should link requests, deployments, configuration changes, logs, and service responses to the governing policy or model version, source evidence, decision, approver, exception, action, and final outcome.
Practical payment example
A checkout deploys a restrictive content security policy to reduce script-injection exposure while explicitly allowing its trusted payment integration.
Operational checks
CSP limits what injected content can do, but secure coding and output handling must still remove the underlying vulnerability. A production treatment of Content Security Policy (CSP) should test a browser-enforced policy that restricts which resources a web page may load, execute, embed, or connect to within the relevant asset, decision, or service state.
Distinctions and limits
CSP remains defense in depth because it does not repair the underlying injection or authorization vulnerability. Unlike a general browser-security recommendation, CSP is used to restrict permitted content sources and execution behavior; for example, a report-only policy can reveal violations before blocking is enforced.
Related reading
Related definitions: Security Policy.
Example
A checkout deploys a restrictive content security policy to reduce script-injection exposure while explicitly allowing its trusted payment integration.
Comparison
CSP remains defense in depth because it does not repair the underlying injection or authorization vulnerability. Unlike a general browser-security recommendation, CSP is used to restrict permitted content sources and execution behavior; for example, a report-only policy can reveal violations before blocking is enforced.
Key Takeaway
CSP limits what injected content can do, but secure coding and output handling must still remove the underlying vulnerability.
Sources
- NIST Documentation: Cyberframework — NIST (2026-07-30)