Content Security Policy (CSP) Guide: Stop XSS & Data Injection

167 views 1 min read
Content Security Policy (CSP) Guide: Stop XSS & Data Injection

Content Security Policy (CSP) Guide: Stop XSS & Data Injection

CSP restricts which resources the browser can load, blocking many XSS vectors.

How CSP Works

Define allowed sources via directives (e.g., default-src, script-src, img-src).

Starter Policy

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{{RANDOM}}'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; upgrade-insecure-requests;

Report-Only First

Deploy in Report-Only to observe breakage before enforcing.

Common Pitfalls

  • Using unsafe-inline forever.
  • Forgetting to rotate nonces.
  • Overly broad CDNs in script-src.

Get a header audit and CSP suggestions with SEOcheck AI.

Back to blog