CContent Security Policy (CSP)

Content Security Policy (CSP) is an HTTP security header that acts as a gatekeeper for your website. It defines which sources your browser is allowed to load resources from—including scripts, stylesheets, images, and fonts. By restricting where content can come from, CSP blocks malicious scripts that attackers might try to inject into your pages.

For business owners, CSP matters because it's a frontline defence against common web attacks. If a malicious actor gains access to your website or a third-party service you use, CSP can stop their scripts from running. This protects customer data, prevents credential theft, and reduces the risk of your site being used to distribute malware. It's particularly critical for sites handling payments or sensitive customer information.

CSP works by declaring trusted sources in an HTTP header. For example, you might allow scripts only from your own domain and a trusted analytics provider, blocking everything else. Modern browsers enforce these rules automatically. There are different directive levels—some policies are strict and restrictive, others more permissive depending on your needs. Implementation requires planning: too restrictive and legitimate features break; too loose and you lose protection.

Getting CSP right takes technical knowledge. Many websites either skip it entirely or misconfigure it, creating gaps in their security. The policy must be tailored to your specific site architecture, third-party integrations, and business requirements.