Skip to content

Content-Security-Policy (CSP) Header

Declares which sources a page is allowed to load scripts, styles, images and other resources from, restricting what injected content can do.

Last updated August 9, 2026.

Severity when missing: Medium — see the missing-header finding on the security headers checker.

Check if your site sends this header

What it does

Content-Security-Policy (CSP) is a response header made up of directives — `default-src`, `script-src`, `style-src`, `img-src`, `object-src`, `frame-ancestors`, and more — that tell the browser which origins are allowed to supply each type of resource on the page. Anything not on the allow-list is blocked by the browser itself, regardless of what the page's HTML or JavaScript tries to do.

Why it matters

CSP is one of the strongest browser-side defenses against cross-site scripting (XSS) and content-injection attacks. If an attacker manages to inject a `<script>` tag or an inline event handler into a page (through a comment field, a stored-XSS bug, a compromised third-party script), a well-configured CSP stops the browser from executing it because the injected content doesn't come from — or match the rules of — an allowed source. It also restricts framing and mixed content when the right directives are set.

Example header

Example only — this is not evidence from a live scan.

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'

How to test for it

  • Run `curl -sI https://example.com` and check for a `Content-Security-Policy` header (or `Content-Security-Policy-Report-Only` while testing).
  • Use your browser's DevTools console — CSP violations are logged there, which is the fastest way to see what a policy would break before enforcing it.
  • Start with `Content-Security-Policy-Report-Only` plus a `report-uri`/`report-to` directive to collect violations without breaking the site, then switch to enforcing once the policy is clean.

How to add it

Nginx

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;

Apache

Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self';"

Cloudflare

Rules → Transform Rules → Modify Response Header → set `Content-Security-Policy` to your policy string (or set it in a Worker if the value needs to vary per route).

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guidesWebsite security scanner

Standards reference

MDN — Content-Security-Policy. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.