What is a Content Security Policy (CSP)?

A Content-Security-Policy is a header that tells browsers exactly which sources of scripts, styles, images and frames your pages are allowed to load - and to block everything else:

• The main browser-side defence against injected code - if an attacker manages to slip a malicious script into a page, a comment field or a compromised plugin, a well-built CSP stops the browser from running it.
• It takes care to get right - a policy that is too strict can break your own analytics, fonts or payment widgets, which is why four in five Australian small business websites have no Content-Security-Policy header at all^*.
• The practical path - start in report-only mode, watch what the policy would have blocked, then enforce.

A CSP is the difference between an injected script being an incident and being a log line.