CSP and browser security blog
Practical guides to Content Security Policy, the browser Reporting API and the HTTP security headers around them: how each one behaves, what its reports actually contain, and how to roll it out on a live site without breaking it.
X-Frame-Options vs frame-ancestors, which clickjacking control to use
X-Frame-Options and the CSP frame-ancestors directive both control who may frame your page. What each does, which one wins, and why you send both.
CentralCSP Team ·
How to add a fresh CSP nonce to a static site with nginx
A static site has no backend to mint a CSP nonce. Put an unguessable placeholder in your HTML and let nginx generate and inject a fresh nonce on every request.
CentralCSP Team ·
script-src-elem vs script-src-attr, which CSP directive controls what
script-src-elem controls script elements and script-src-attr controls inline event handler attributes. How they split script-src and when to set each.
CentralCSP Team ·
SameSite vs CSRF tokens, does the cookie attribute replace the token
SameSite is real CSRF defense in depth but it is site-scoped and browser-dependent, so it does not replace CSRF tokens. Why you keep both.
CentralCSP Team ·
no-cache vs no-store, which Cache-Control directive keeps data private
no-cache lets a response be stored but revalidated, no-store forbids storing it at all. For sensitive pages you want no-store. The confusion, cleared up.
CentralCSP Team ·
HSTS vs upgrade-insecure-requests, do you need both
HSTS forces HTTPS at the navigation level and upgrade-insecure-requests rewrites mixed-content subresources. They are complementary, not alternatives.
CentralCSP Team ·
Where browser CSP reports go and how to receive them
A CSP report endpoint is just a URL the browser POSTs violations to. Learn the content types, the volume problem, and build vs buy a collector.
CentralCSP Team ·
What unsafe-eval does in CSP and how to remove it
unsafe-eval re-enables eval, new Function, and string timers, which weakens your CSP against XSS. Here is where it sneaks in and how to drop it.
CentralCSP Team ·
Automatic SRI hashes with webpack and Vite
Hashing every chunk by hand is impractical. Let webpack and Vite generate SRI integrity attributes at build time, and watch the CDN scripts they cannot cover.
CentralCSP Team ·
SRI vs CSP hash, two hashes that do different jobs
SRI and CSP hashes look alike but verify different things. SRI checks an external file's bytes, a CSP hash allowlists inline code. Here is the difference.
CentralCSP Team ·
ReportingObserver, catch deprecations and CSP violations in JavaScript
ReportingObserver lets a page read its own deprecation, intervention, and CSP reports in JavaScript, no header needed. How to wire it into a front-end pipeline.
CentralCSP Team ·
Lock down browser features with Permissions-Policy and get reports
Permissions-Policy controls which powerful browser features a page and its iframes can use. The header syntax, the allow attribute, and how to get violation reports.
CentralCSP Team ·
PCI DSS v4 client-side security explained for compliance owners
A plain-language guide to PCI DSS v4 requirements 6.4.3 and 11.6.1, what evidence an auditor wants, and how script inventory and change detection supply it.
CentralCSP Team ·
Magecart and formjacking, how to detect a client-side skimmer
What Magecart and formjacking are, why a server never sees the skimmer, and how a script inventory, change alerting, and a strict CSP detect it.
CentralCSP Team ·
Enforce SRI across every script with Integrity-Policy
The Integrity-Policy response header enforces Subresource Integrity on every script with one header and reports the scripts that lack it.
CentralCSP Team ·
How to improve your security headers grade
A low security headers grade has a fix list. Set CSP, HSTS, X-Content-Type-Options, frame-ancestors, Referrer-Policy, and Permissions-Policy correctly.
CentralCSP Team ·
How to set up the browser Reporting API
Declare a reporting endpoint, point a policy at it, and read the first report the browser sends. A practical, end-to-end walkthrough.
CentralCSP Team ·
Google Tag Manager under a strict CSP in Next.js
Run Google Tag Manager in a Next.js App Router app under a strict nonce and strict-dynamic CSP. Per-request nonce, the GTM bootstrap, and where Google hosts go.
CentralCSP Team ·
How attackers abuse Google Tag Manager, and how a strict CSP contains it
Google Tag Manager exists to inject scripts, so a compromised container ships JS to every page. How a strict CSP, script inventory, and change alerting contain it.
CentralCSP Team ·
How to generate a Subresource Integrity (SRI) hash
Generate a Subresource Integrity hash with the SRI generator, add the integrity and crossorigin attributes, and avoid the traps that break it.
CentralCSP Team ·
Clickjacking protection when you cannot set a CSP header
frame-ancestors only works as a real header, not in a meta tag. Learn the X-Frame-Options fallback and what to do when headers are limited.
CentralCSP Team ·
How to fix an Unsafe Implementation of Subresource Integrity finding
A security rating flagged an Unsafe Implementation of Subresource Integrity finding. The remediation workflow, find the scripts, hash them, roll out safely.
CentralCSP Team ·
How to fix SecurityScorecard CSP findings
Map each SecurityScorecard Content Security Policy finding to a concrete report-only to enforce fix, from a missing header to broad directives.
CentralCSP Team ·
How to enable Trusted Types with CSP to stop DOM XSS
Turn Trusted Types on with require-trusted-types-for script and the trusted-types directive to lock down DOM XSS sinks, rolled out report-only first.
CentralCSP Team ·
CORP vs COEP, two sides of cross-origin isolation
CORP is set by a resource to say who may embed it, COEP is set by a page to require every cross-origin resource to opt in. How the two headers work together.
CentralCSP Team ·
Configure per-document features with Document-Policy
What the Document-Policy header does, the report-only variant, and how to get document-policy-violation reports through the Reporting API.
CentralCSP Team ·
Deprecation and intervention reports, catch breaking browser changes early
Deprecation reports warn that an API is going away and intervention reports flag a browser override. How both arrive over the Reporting API and how to use them.
CentralCSP Team ·
How to debug CSP violations in Chrome DevTools
Read the Refused to load console message, use the Issues panel, and map a CSP violation back to the directive you need to fix.
CentralCSP Team ·
CSP and PCI DSS v4, meeting 6.4.3 and 11.6.1 on payment pages
What PCI DSS v4 requirements 6.4.3 and 11.6.1 require on payment pages, and how a CSP plus script inventory and change alerting give you the evidence.
CentralCSP Team ·
How to set up a CSP nonce, per request, in Express, Next.js, and nginx
A CSP nonce allows specific inline scripts without unsafe-inline. Here is how to generate one per request and wire it up in Express, Next.js, and nginx.
CentralCSP Team ·
How to generate a CSP hash (sha256) for an inline script
A CSP hash allowlists one exact inline script by its content. Here is how to compute a sha256 hash, where it goes, and how it compares to a nonce.
CentralCSP Team ·
Connection Allowlists, a network egress sandbox in the browser
Connection Allowlists let a page declare every destination it may connect to, so the browser blocks data exfiltration through any channel. How the new header works.
CentralCSP Team ·
Browser crash and unresponsive reports, a client-side availability signal
Crash reports tell you when the tab running your page died or hung, delivered next time the browser loads your origin. What they contain and how to read them.
CentralCSP Team ·
report-uri vs report-to, and how to migrate
report-uri is the deprecated CSP reporting directive and report-to is its modern replacement. What changed, how they differ, and how to send both safely.
CentralCSP Team ·
How to read a CSP violation report
What each field in a CSP violation report means, in both the modern Reporting API shape and the legacy report-uri shape, so you can read a live report.
CentralCSP Team ·
How to set the Content-Security-Policy header in every framework
Copy-paste ways to send the CSP header in nginx, Apache, Express, Django, Next.js, Nuxt, Laravel, and Angular, and how to verify it is actually sent.
CentralCSP Team ·
strict-dynamic explained, drop host allowlists for a strict CSP
What the strict-dynamic keyword does, how it works with a nonce or hash, and why it lets you stop maintaining long host allowlists in your CSP.
CentralCSP Team ·
CSP for Google services, the host cheat sheet
Which Content Security Policy directives each Google service needs, Maps, Fonts, reCAPTCHA, YouTube, and Ads, with a Report-Only first workflow.
CentralCSP Team ·
Report-To vs Reporting-Endpoints, migrate off the deprecated header
Report-To is the deprecated v0 reporting header and Reporting-Endpoints is the modern v1 replacement. What changed, and the one case where you still need Report-To.
CentralCSP Team ·
What is NEL, network error logging from the browser
Network Error Logging reports DNS, TLS, connection, and HTTP failures from the browser, including ones that never reach your server.
CentralCSP Team ·
COOP and COEP explained, cross-origin isolation made practical
What Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy do, why you need both for cross-origin isolation, and how to roll them out report-only first.
CentralCSP Team ·
Legacy security headers you can retire
X-Frame-Options, X-XSS-Protection, Feature-Policy, and report-uri have modern replacements. Which old headers to drop, which to keep, and what replaces each.
CentralCSP Team ·
A CSP starter template you can copy and tighten
A strict Content Security Policy starter you can paste, run in report-only, and tighten line by line, with a per-directive cheat sheet.
CentralCSP Team ·
The CentralCSP Chrome extension
Author, debug, and roll out a Content Security Policy against real production pages from your browser, no deploy needed, with the free CentralCSP extension.
CentralCSP Team ·
trusted-types-eval, a safer way to allow eval in CSP
trusted-types-eval permits eval and Function only when Trusted Types are enforced, so it replaces unsafe-eval without leaving older code wide open.
CentralCSP Team ·
How CSP report-sha keywords reveal every script that loads
How the Content Security Policy report-sha256, report-sha384, and report-sha512 keywords report script hashes so you can inventory what runs on your pages.
CentralCSP Team ·
The Reporting-Endpoints header explained
How the Reporting-Endpoints HTTP header and the CSP report-to directive route browser reports, with syntax, the default endpoint, and the send-both pattern.
CentralCSP Team ·
The blob scheme in Content Security Policy
blob URLs need an explicit allowlist in CSP. self and the wildcard do not cover them, and allowing blob in script-src acts like unsafe-eval.
CentralCSP Team ·
The data scheme in Content Security Policy
Why data is fine in img-src and font-src but a real XSS vector in script-src, and how to allow it per directive without weakening your CSP.
CentralCSP Team ·
Build a script inventory with CSP hash reporting
Use Content Security Policy hash reporting to inventory every script the browser runs, and produce evidence for PCI DSS v4 6.4.3 and 11.6.1.
CentralCSP Team ·
How to protect CDN scripts with Subresource Integrity
Subresource Integrity lets the browser verify a CDN script or stylesheet matches a hash you supply, blocking tampered third-party code.
CentralCSP Team ·
How to build a strong CSP, step by step
A practical workflow for building a Content Security Policy, start in Report-Only, collect real violations, build the policy, validate, then enforce.
CentralCSP Team ·
How to use the CSP Builder
Build a working Content Security Policy from real violation reports. Pick a policy, set a window, generate, review each source, then deploy.
CentralCSP Team ·
BitSight RAU25 and why CSP is now rated
BitSight RAU25 retired Web Application Headers for Web Application Security on July 10 2025. Here is how Content Security Policy is scored, and how to fix it.
CentralCSP Team ·
How to fix BitSight Content Security Policy findings
A practical report-only to enforce workflow to remediate BitSight CSP findings under the RAU25 Web Application Security rating.
CentralCSP Team ·
How JSONP endpoints bypass your CSP
A host allowlist that trusts a JSONP endpoint hands attackers arbitrary script execution. Here is how the bypass works and how to close it.
CentralCSP Team ·
Why you should never use unsafe-inline in CSP
unsafe-inline re-enables the inline scripts CSP blocks by default, which defeats its XSS protection. Use nonces, hashes, or external files instead.
CentralCSP Team ·
Get started with Content Security Policy
A beginner guide to CSP. What it is, how to deliver it, your first policy, your first nonce, and how to test safely with Report-Only.
CentralCSP Team ·
How to set up a CSP nonce in Next.js
Add a strict nonce-based Content Security Policy to a Next.js App Router app. Generate the nonce in proxy.ts and let Next auto-nonce its scripts.
CentralCSP Team ·
CSP for Google Analytics and Tag Manager with a nonce
Run GA4 and Google Tag Manager under a strict CSP using a nonce and strict-dynamic. No Google hosts in script-src, with a full example header.
CentralCSP Team ·
Get started with CSP reporting
Set up CSP violation reporting the modern way with Reporting-Endpoints and report-to, start in report-only, and read the report payload.
CentralCSP Team ·
CSP enforce vs report-only mode
Content-Security-Policy blocks violations, Report-Only only watches. When to use each, how to run both, and how to read the disposition field.
CentralCSP Team ·
Multiple CSP policies on one page
How a browser combines multiple Content Security Policy headers, meta, and Report-Only on a single document, and why extra policies only ever restrict.
CentralCSP Team ·
CSP meta tag vs HTTP header
Deliver your Content Security Policy in an HTTP header, not a meta tag. Headers apply earlier and support every directive and report-only.
CentralCSP Team ·