Content Security Policy

A Content Security Policy (CSP) is a list a website gives the browser of the places its pages may load scripts from and send data to. The browser blocks anything not on the list, which protects visitors if someone manages to slip their own code into a page.

A site usually sends its policy as a Content-Security-Policy header, or sets it in a <meta> tag. Each part of the policy covers one kind of content: script-src lists where scripts may load from, and connect-src lists where a page may send data. A tool you add to your site, such as an analytics script, only works if the policy allows the addresses it uses.

Learn more

• Content Security Policy Level 3 - W3C specification
• Content Security Policy (CSP) - MDN guide
• Content Security Policy check