Content-Security-Policy (CSP) Header
Declares which sources a page is allowed to load scripts, styles, images and other resources from, restricting what injected content can do.
Last updated August 9, 2026.
Severity when missing: Medium — see the missing-header finding on the security headers checker.
What it does
Content-Security-Policy (CSP) is a response header made up of directives — `default-src`, `script-src`, `style-src`, `img-src`, `object-src`, `frame-ancestors`, and more — that tell the browser which origins are allowed to supply each type of resource on the page. Anything not on the allow-list is blocked by the browser itself, regardless of what the page's HTML or JavaScript tries to do.
Why it matters
CSP is one of the strongest browser-side defenses against cross-site scripting (XSS) and content-injection attacks. If an attacker manages to inject a `<script>` tag or an inline event handler into a page (through a comment field, a stored-XSS bug, a compromised third-party script), a well-configured CSP stops the browser from executing it because the injected content doesn't come from — or match the rules of — an allowed source. It also restricts framing and mixed content when the right directives are set.
Example header
Example only — this is not evidence from a live scan.
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'How to test for it
- Run `curl -sI https://example.com` and check for a `Content-Security-Policy` header (or `Content-Security-Policy-Report-Only` while testing).
- Use your browser's DevTools console — CSP violations are logged there, which is the fastest way to see what a policy would break before enforcing it.
- Start with `Content-Security-Policy-Report-Only` plus a `report-uri`/`report-to` directive to collect violations without breaking the site, then switch to enforcing once the policy is clean.
How to add it
Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self';"Cloudflare
Rules → Transform Rules → Modify Response Header → set `Content-Security-Policy` to your policy string (or set it in a Worker if the value needs to vary per route).Verify the fix
After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.
FAQ
Does CSP replace input sanitization?
No. CSP is a second layer, not a substitute — it restricts what a browser will execute or load even if attacker-controlled markup does get rendered. Sanitizing and escaping user input remains the primary defense; CSP is what limits the damage when that primary defense has a gap.
Why does a single default-src * count as no CSP at all?
default-src is the fallback every other fetch directive inherits from when not set individually. A default-src of * or a bare scheme like https: places no real restriction on script or resource origins, so a browser applying that policy behaves exactly as it would with the header absent — which is why Nivaronix reports it identically to a missing header.
What's the difference between CSP report-only mode and enforcing mode?
Content-Security-Policy-Report-Only sends violation reports without blocking anything, which is the standard way to test a new policy against real traffic before switching to the enforcing Content-Security-Policy header. Skipping report-only and deploying an enforcing policy directly risks breaking legitimate scripts you didn't know the site depended on.
Do I need 'unsafe-inline' in my script-src?
Only if the page has inline <script> tags or inline event handlers you haven't moved to external files or nonces. unsafe-inline defeats most of CSP's XSS protection because it re-permits exactly the inline-script injection pattern the policy exists to stop. Nonces or hashes let specific inline scripts run without opening that door for attacker-injected ones.
Standards reference
MDN — Content-Security-Policy. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.