Content Security Policy

Definitions

1. An HTTP response header that restricts which resources (scripts, styles, images, fonts) a browser is allowed to load for a page. A powerful defense against XSS attacks by whitelisting trusted sources and blocking inline scripts.

   In plain English: A security rule that tells the browser exactly which scripts and resources are allowed to run on your page.

   Example: "Add a strict CSP header — script-src 'self' blocks all inline scripts and third-party JS injections."

Related Terms

• CORS
• CORS Preflight
• HSTS
• Security Headers
• Clickjacking
• HTTP Strict Transport Security
• Blind XSS
• Reflected Input