CSP header guide

Content Security Policy Header: What CSP Does and How to Check It

The Content-Security-Policy header — usually shortened to the CSP header — tells the browser which sources it is allowed to load content from on your pages. Its main purpose is to limit the damage done when untrusted content ends up on a page, most commonly through cross-site scripting.

CSP is the most powerful of the common security headers and also the easiest to get wrong, because a policy has to match the way your particular site is built.

Check your website security headers

What a Content-Security-Policy header actually does

A CSP is a list of rules, called directives, that describe permitted sources for different kinds of resources: scripts, stylesheets, images, fonts, frames and connections. When the browser is asked to load something the policy does not allow, it refuses and logs the refusal in the console.

The practical effect is that a script injected by an attacker often cannot run or cannot send data anywhere useful, because it does not come from a source the policy permits. That is meaningful risk reduction, but it depends entirely on how well the policy reflects your site.

Why one-size-fits-all CSP strings are unsafe

Copying a policy from a blog post is the most common way to break a site. Your policy has to allow the analytics, payment widgets, embedded video, chat tools, fonts and CDNs your site genuinely uses. A borrowed string will either block something you need or be so permissive that it does very little.

The opposite failure is just as common: a policy loose enough to allow inline scripts from anywhere gives a false sense of protection. A useful CSP is derived from an inventory of what your site loads, then tightened over time.

Report-Only: the safer way to roll out a policy

Browsers support a Content-Security-Policy-Report-Only header. It applies exactly the same rules but does not block anything — it only reports what would have been blocked. Running Report-Only for a period on a live site is the standard way to discover the resources you forgot about before switching to an enforced policy.

A reasonable sequence is: inventory what the site loads, publish a draft policy in Report-Only, review the reports and console messages over normal traffic, adjust, then enforce. Keep the ability to revert.

How to check a CSP header in Chrome

Open the page, press F12, go to the Network tab and reload. Select the document request and look under Response Headers for Content-Security-Policy or Content-Security-Policy-Report-Only. The Console tab shows any CSP violations triggered while you browse, which is the fastest way to see whether an enforced policy is blocking something it should not.

You can also run the free website security check on this site to see whether a CSP header is returned at all on your public pages.

Check your website security headers

ScoutLab's free website security check looks at whether these headers are present and how they are configured on your public site, alongside HTTPS, DNS and email protection signals. It reports what it observes so you can discuss the results with whoever maintains your website.

Run the free website security check

Keep reading

Security headers explained: the full ScoutLab guideStart with the hub guide for how the main browser-facing response headers fit together.

X-Frame-Options and CSP frame-ancestorsCSP also handles framing control, which is where frame-ancestors comes in.

Run the free website security checkSee which of these headers your site currently returns.

Frequently asked questions

What is a Content Security Policy header?

It is an HTTP response header that lists the sources a browser may load scripts, styles, images, fonts and frames from on your pages. Anything outside the policy is refused by the browser, which limits what injected or untrusted content can do.

How do I check the Content Security Policy header in Chrome?

Press F12 to open DevTools, select the Network tab, reload the page and click the top document request. Under Response Headers look for Content-Security-Policy or Content-Security-Policy-Report-Only. The Console tab lists any violations that occur as you use the site.

What is the difference between CSP and CSP Report-Only?

An enforced Content-Security-Policy blocks anything the policy does not permit. Content-Security-Policy-Report-Only evaluates the same rules but allows the content to load and simply reports what would have been blocked, which makes it the safer way to trial a new policy on a live site.

Can I copy a CSP header from another website?

It is not advisable. A policy has to match the scripts, fonts, media and third-party tools your own site loads. A copied policy usually either blocks something your site needs or is written so loosely that it adds little value. Build the policy from your own resource inventory and test it in Report-Only first.

Does a CSP header stop all cross-site scripting?

No. A well-built policy substantially reduces what an injected script can do, but it does not remove the underlying flaw that allowed the injection. Input handling, output encoding and keeping software current still matter.

Technical references

Security headers are browser-facing HTTP response controls and one layer of defence. They work alongside patching, access control, backups and monitoring rather than replacing them.