CSP

/see-ess-pee/ · noun · Security & Infosec · Origin: 2012

Definitions

  1. Content Security Policy — an HTTP header that tells the browser which sources of content (scripts, styles, images, fonts) are allowed to load on a page. CSP is the most effective defense against XSS attacks, as it prevents inline scripts and restricts where code can be loaded from. Deploying a strict CSP on a legacy codebase is notoriously painful.

    In plain English: A security setting that tells the browser which sources of code and content are allowed on your website — blocks hackers from injecting malicious scripts.

    Example: Adding CSP with script-src 'self' broke half the marketing team's third-party analytics tags, but it also killed three XSS vulnerabilities we didn't know about.

Related Terms