In today’s digital landscape, websites and web applications face constant security threats, especially from attacks like Cross-Site Scripting (XSS), clickjacking, and data injection. While firewalls, HTTPS, and server hardening provide strong defenses, modern browsers also offer mechanisms to safeguard users directly. One such mechanism is Content Security Policy (CSP).
CSP acts as a powerful security layer that defines which content is allowed to load in a web page. By restricting the sources of scripts, images, styles, and other resources, CSP helps prevent malicious code execution.
What is CSP?
Content Security Policy is a browser-level security standard that allows web administrators to control resources the browser is allowed to load for a given page.
- Without CSP, any injected script (via XSS vulnerability) might execute freely.
- With CSP, only explicitly trusted sources are allowed.
CSP is enforced by adding a HTTP response header (Content-Security-Policy) or a <meta> tag in the HTML <head>.
Why CSP is Important
- Protects Against XSS Attacks – Limits which scripts can run, preventing injection-based hacks.
- Mitigates Data Injection – Stops attackers from loading unauthorized resources.
- Reduces Clickjacking Risks – By restricting framing with directives like
frame-ancestors. - Improves Compliance – Helps meet requirements of security standards like OWASP Top 10 and PCI DSS.
- Builds User Trust – Visitors know that your site enforces strict security policies.
How CSP Works
When a browser loads a web page:
- It checks the CSP rules in headers or meta tags.
- It only loads resources from allowed sources (e.g., self-hosted or trusted CDNs).
- Any violation is blocked and logged in the browser console.
Common CSP Directives
Here are some important directives to know:
- default-src – Fallback for all resources (scripts, images, CSS, etc.).
- script-src – Defines trusted sources for JavaScript.
- style-src – Controls where CSS can load from.
- img-src – Defines allowed sources for images.
- font-src – Restricts fonts to specific sources.
- connect-src – Defines valid endpoints for AJAX, WebSockets, APIs.
- frame-ancestors – Restricts which sites can embed your page in
<iframe>. - report-uri / report-to – Sends violation reports to a monitoring endpoint.
Example CSP Policy
Strict CSP Example:
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self';
Explanation:
'self'→ Only allow content from the same domain.object-src 'none'→ Blocks Flash, Silverlight, or other plugins.frame-ancestors 'none'→ Prevents clickjacking.base-uri 'self'→ Restricts base URL to your domain.
Deploying CSP on Web Servers
1. Apache
In your .htaccess or Apache config:
Header set Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted-cdn.com; object-src 'none';"
2. Nginx
Inside the server block:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted-cdn.com; object-src 'none';";
3. Microsoft IIS
Add a custom HTTP response header:
- Name:
Content-Security-Policy - Value:
default-src 'self'; script-src 'self'; object-src 'none';
CSP Reporting Mode
If you’re worried about breaking the site with strict CSP, start with Report-Only mode:
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; report-uri /csp-report-endpoint;
This won’t block resources but will log violations. It’s a great way to test before full enforcement.
Best Practices for Implementing CSP
- Start with Report-Only → Identify what your site needs.
- Avoid Wildcards (
*) → Always specify trusted domains. - Minimize Use of
'unsafe-inline'&'unsafe-eval'→ These weaken protection. - Use Nonce or Hash for Inline Scripts → Safer than allowing all inline code.
- Combine CSP with Other Headers → Use CSP along with
X-Frame-Options,Strict-Transport-Security (HSTS), etc.
Tools for Testing CSP
- Google CSP Evaluator – https://csp-evaluator.withgoogle.com/
- Mozilla Observatory – https://observatory.mozilla.org/
- Report URI – https://report-uri.com/
Conclusion
A well-configured Content Security Policy is one of the most effective safeguards against modern web attacks. While implementing CSP might seem complex initially, starting with a report-only policy, refining your rules, and gradually enforcing them can significantly boost your website’s resilience against threats.
By combining CSP with other security best practices, you can strengthen trust, ensure compliance, and protect both your data and your users.
