# Content-Security-Policy (CSP)

> Content-Security-Policy (CSP) is an HTTP header that lists the sources a page may load scripts, styles, images and frames from. It is the main defence against XSS.

- **Check ID:** SEC3
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/content-security-policy-csp

## Why it matters

XSS is one of the most common web vulnerabilities. An attacker can inject malicious JavaScript that steals cookies, redirects to a phishing site, or modifies page content. CSP prevents the execution of unauthorized scripts by precisely defining allowed sources.

## In practice

Cloudflare.com uses a strict CSP with the rule script-src 'self', which only allows scripts from its own domain. If an attacker injects an external script from a foreign domain, the browser blocks it because that domain is not on the allowed list.

## How be1st checks it

Checks for the presence of the Content-Security-Policy HTTP header, which defines from which origins the browser may load scripts, styles, images, and other resources. CSP is the most effective defense against XSS (Cross-Site Scripting) attacks.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Content-Security-Policy (CSP) header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy) (MDN)
- [Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) (OWASP)

## Related terms

- [X-Frame-Options](https://be1st.ai/glossary/security/x-frame-options): X-Frame-Options is an HTTP header that decides whether other websites may embed your page in a frame. It protects visitors against clickjacking.
- [X-Content-Type-Options](https://be1st.ai/glossary/security/x-content-type-options): X-Content-Type-Options: nosniff is an HTTP header that stops browsers from guessing a file's type, so a file cannot run as something it was not sent as.
- [Referrer-Policy](https://be1st.ai/glossary/security/referrer-policy): Referrer-Policy is an HTTP header that controls how much of the current URL the browser sends to other sites when a visitor follows a link or a resource loads.
- [Permissions-Policy](https://be1st.ai/glossary/security/permissions-policy): Permissions-Policy is an HTTP header that turns browser features such as the camera, microphone or geolocation on or off for a page and its frames.
- [Mixed content](https://be1st.ai/glossary/security/mixed-content): Mixed content means resources, such as images or scripts, that an HTTPS page loads over unencrypted HTTP. Browsers block or flag them.
- [Security warnings](https://be1st.ai/glossary/security/security-warnings): Security warnings are messages the browser writes to its console when it finds a security problem on a page, such as a blocked resource or an invalid policy.