CyberGuard dictionary / Web Application Security
Content Security Policy
Also known as CSP
A browser policy that restricts which resources and scripts a web page may load or execute.
In simple terms
CSP tells a browser which sources of page content are allowed.
Technical explanation
A Content-Security-Policy response header can constrain scripts, styles, frames, and other resources; it is defense in depth rather than a substitute for output encoding.
CSP restricts which sources and execution patterns a browser may accept. A policy should be tested in report-only mode and tuned carefully, because broad allowances can leave an injection path open.
Examples in practice
A site blocks scripts from unknown domains even if an injected tag appears in a page.
The site removes inline script allowances and loads approved scripts with nonces. A test injection is blocked, while legitimate checkout code still works after the policy change.
Why it matters
A carefully tested policy can reduce the impact of some XSS paths.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.