HTTP Security Header
Content-Security-Policy (CSP)
Prevents Cross-Site Scripting (XSS) and data injection attacks by restricting which dynamic resources are allowed to load.
Configuration Snapshot
- Header Name
- Content-Security-Policy (CSP)
- Primary Mitigation
- Cross-Site Scripting (XSS), Clickjacking, Packet Sniffing
Example Configuration
Content-Security-Policy: default-src 'self'; img-src https://*; child-src 'none';
Implementation Best Practices
- Avoid using unsafe-inline and unsafe-eval
- Start in report-only mode to identify legitimate blocked resources
- Define strict fallback default-src directives
Audit Your Configuration
Properly implementing Content-Security-Policy (CSP) is critical for achieving a robust security posture. A misconfigured header can leave your application exposed to client-side attacks or accidentally block legitimate functionality. Use our Security Headers auditing tool to evaluate your live production setup.
Scan Your Website