Content-Security-Policy (CSP) header

The list of sources a page may load scripts, styles and frames from. It is the one header that limits what an injected script can do — unless its script sources allow unsafe-inline, which hands that back.

• Help center

Content-Security-Policy (CSP) lists the sources a page is allowed to load scripts, styles, images, frames and other resources from. If an attacker finds a way to inject HTML, the browser still refuses to run scripts that the policy does not allow. It is the one header that directly limits the damage of cross-site scripting (XSS).

How SiteScan grades it

• “Strong”: an enforced policy whose script sources do not allow 'unsafe-inline' or 'unsafe-eval'. Nonces and hashes are fine.
• “Weak”: the policy allows inline scripts or eval, or it is only Content-Security-Policy-Report-Only, which logs violations but blocks nothing.
• “Missing”: no policy at all.

Separate findings point out a policy without default-src, object-src, base-uri or frame-ancestors, and a * source for scripts. Inline styles are reported but do not lower the grade.

How to start

A solid base: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self', then add the external hosts your pages really use. Deploy it first as Report-Only, watch the reports for a week, then switch to the enforcing header. Replace inline <script> blocks with files or add nonces. More in the guide to security headers.