# Overview (/en/docs/web-security/policies)



A policy is a set of rules the browser enforces, configured through a response
header. Each policy can point its reports at an endpoint, so you see what it would
block before you enforce it. These pages explain what each policy protects against,
how to configure it, and how to wire its reporting. Content Security Policy is the
deepest sub-tree.

## Policies in this section [#policies-in-this-section]

<Cards>
  <Card title="Content Security Policy (CSP)" href="/en/docs/web-security/policies/content-security-policy" description="Control what a page may load and run. The flagship." />

  <Card title="Cross-Origin-Opener-Policy (COOP)" href="/en/docs/web-security/policies/cross-origin-opener-policy" description="Isolate your window from cross-origin openers." />

  <Card title="Cross-Origin-Embedder-Policy (COEP)" href="/en/docs/web-security/policies/cross-origin-embedder-policy" description="Require cross-origin resources to opt in." />

  <Card title="Permissions-Policy" href="/en/docs/web-security/policies/permissions-policy" description="Allow or deny browser features per context." />

  <Card title="Document-Policy" href="/en/docs/web-security/policies/document-policy" description="Constrain per-document behavior." />

  <Card title="Integrity-Policy" href="/en/docs/web-security/policies/integrity-policy" description="Require Subresource Integrity on loaded resources." />

  <Card title="Network Error Logging (NEL)" href="/en/docs/web-security/policies/network-error-logging" description="Report network-level request failures." />

  <Card title="Connection-Allowlist" href="/en/docs/web-security/policies/connection-allowlist" description="Declare the destinations a page may connect to, deny by default." />

  <Card title="Legacy security headers" href="/en/docs/web-security/policies/legacy-headers" description="Older headers and their modern replacements." />
</Cards>

## How a policy reports [#how-a-policy-reports]

Every policy points at an endpoint declared in a [header](/en/docs/web-security/reporting-api/headers),
but each names it a little differently:

* **CSP** uses the `report-to` directive (and the deprecated `report-uri`).
* **COOP, COEP, Permissions-Policy, and Connection-Allowlist** use a `report-to=` parameter on the header.
* **Integrity-Policy** uses the `endpoints=()` directive.
* **NEL** is the exception: it names a group in the legacy `Report-To` header, not
  `Reporting-Endpoints`.

Whichever a policy uses, the name has to match one declared on the same response,
and the browser then emits the matching [report type](/en/docs/web-security/reporting-api/reports).

## See also [#see-also]

* [Headers](/en/docs/web-security/reporting-api/headers)
* [Report types](/en/docs/web-security/reporting-api/reports)
* [Security headers](/en/docs/web-security/security-headers), the headers that do not emit reports: HSTS, cookie attributes, nosniff, Referrer-Policy
* Monitor every policy in one place with [CentralCSP](/en/docs/platform/monitoring).