# Overview (/en/docs/web-security/policies/content-security-policy)



Content Security Policy (CSP) is an HTTP response header that tells the browser which
resources a page is allowed to load and execute. The browser enforces it: a script,
stylesheet, image, frame or connection that no directive permits is blocked before it
runs. That is what makes CSP the primary defense against cross-site scripting (XSS) and
content injection, and the reason it is the only control that stops an injected script
even when the injection itself succeeds.

A policy is a semicolon-separated list of directives, each naming a resource type and
the sources allowed for it:

```http
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-r4nd0m'; object-src 'none'; base-uri 'none'
```

CSP can also report instead of block. `Content-Security-Policy-Report-Only` carries the
same policy, enforces nothing, and sends a
[csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation) for
everything it would have blocked, so you can measure a policy against real traffic before
you turn it on.

## The parts of a policy [#the-parts-of-a-policy]

| Part        | What it is                                                                                                               | Reference                                                                                        |
| ----------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ |
| Header      | `Content-Security-Policy` enforces, `-Report-Only` only reports. A `<meta>` element can carry a policy too, with limits. | [Headers](/en/docs/web-security/policies/content-security-policy/introduction/csp-headers)       |
| Directive   | The resource type being governed: `script-src`, `img-src`, `frame-ancestors`.                                            | [Directives](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives) |
| Source list | The values after a directive: keywords, hosts, schemes, hashes, nonces.                                                  | [Values](/en/docs/web-security/policies/content-security-policy/values/csp-keywords)             |
| Fallback    | Most fetch directives fall back to `default-src` when absent.                                                            | [`default-src`](/en/docs/web-security/policies/content-security-policy/directives/default-src)   |
| Reporting   | `report-to` (and legacy `report-uri`) name where violations are sent.                                                    | [`report-to`](/en/docs/web-security/policies/content-security-policy/directives/report-to)       |

## Directives by role [#directives-by-role]

Every directive has its own page. Grouped by what it governs:

| Role                  | Directives                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Fetch                 | [`default-src`](/en/docs/web-security/policies/content-security-policy/directives/default-src), [`script-src`](/en/docs/web-security/policies/content-security-policy/directives/script-src), [`script-src-elem`](/en/docs/web-security/policies/content-security-policy/directives/script-src-elem), [`script-src-attr`](/en/docs/web-security/policies/content-security-policy/directives/script-src-attr), [`style-src`](/en/docs/web-security/policies/content-security-policy/directives/style-src), [`style-src-elem`](/en/docs/web-security/policies/content-security-policy/directives/style-src-elem), [`style-src-attr`](/en/docs/web-security/policies/content-security-policy/directives/style-src-attr), [`img-src`](/en/docs/web-security/policies/content-security-policy/directives/img-src), [`font-src`](/en/docs/web-security/policies/content-security-policy/directives/font-src), [`media-src`](/en/docs/web-security/policies/content-security-policy/directives/media-src), [`object-src`](/en/docs/web-security/policies/content-security-policy/directives/object-src), [`connect-src`](/en/docs/web-security/policies/content-security-policy/directives/connect-src), [`manifest-src`](/en/docs/web-security/policies/content-security-policy/directives/manifest-src), [`frame-src`](/en/docs/web-security/policies/content-security-policy/directives/frame-src), [`child-src`](/en/docs/web-security/policies/content-security-policy/directives/child-src), [`worker-src`](/en/docs/web-security/policies/content-security-policy/directives/worker-src), [`fenced-frame-src`](/en/docs/web-security/policies/content-security-policy/directives/fenced-frame-src) |
| Document              | [`base-uri`](/en/docs/web-security/policies/content-security-policy/directives/base-uri), [`sandbox`](/en/docs/web-security/policies/content-security-policy/directives/sandbox)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Navigation            | [`form-action`](/en/docs/web-security/policies/content-security-policy/directives/form-action), [`frame-ancestors`](/en/docs/web-security/policies/content-security-policy/directives/frame-ancestors)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Reporting             | [`report-to`](/en/docs/web-security/policies/content-security-policy/directives/report-to), [`report-uri`](/en/docs/web-security/policies/content-security-policy/directives/report-uri)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Trusted Types         | [`require-trusted-types-for`](/en/docs/web-security/policies/content-security-policy/directives/require-trusted-types-for), [`trusted-types`](/en/docs/web-security/policies/content-security-policy/directives/trusted-types)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Other                 | [`upgrade-insecure-requests`](/en/docs/web-security/policies/content-security-policy/directives/upgrade-insecure-requests), [`webrtc`](/en/docs/web-security/policies/content-security-policy/directives/webrtc)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Deprecated or removed | [`block-all-mixed-content`](/en/docs/web-security/policies/content-security-policy/directives/block-all-mixed-content), [`plugin-types`](/en/docs/web-security/policies/content-security-policy/directives/plugin-types), [`prefetch-src`](/en/docs/web-security/policies/content-security-policy/directives/prefetch-src), [`navigate-to`](/en/docs/web-security/policies/content-security-policy/directives/navigate-to), [`referrer`](/en/docs/web-security/policies/content-security-policy/directives/referrer), [`require-sri-for`](/en/docs/web-security/policies/content-security-policy/directives/require-sri-for)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

## A policy worth copying [#a-policy-worth-copying]

```http
Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'nonce-{RANDOM}';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data:;
  connect-src 'self';
  object-src 'none';
  base-uri 'none';
  frame-ancestors 'none';
  report-to csp-endpoint
```

`object-src 'none'` and `base-uri 'none'` close the two bypasses that defeat an otherwise
strict policy: plugin content, and an injected `<base>` element that repoints every
relative script URL. `frame-ancestors 'none'` is the modern replacement for
`X-Frame-Options`. A fresh nonce per response is what lets you drop `'unsafe-inline'` from
`script-src`, which is where nearly all of CSP's XSS protection comes from.

## Sub-sections [#sub-sections]

<Cards>
  <Card title="Introduction" href="/en/docs/web-security/policies/content-security-policy/introduction/what-is-csp" description="What CSP is, and how directives, values, and headers fit together." />

  <Card title="Report-Only" href="/en/docs/web-security/policies/content-security-policy/report-only" description="The Content-Security-Policy-Report-Only header, testing a policy without enforcing it." />

  <Card title="Values" href="/en/docs/web-security/policies/content-security-policy/values/csp-keywords" description="What goes inside a directive: keywords, host- and scheme-source, hashes and nonce, and the report-sha256 keyword." />

  <Card title="Directives" href="/en/docs/web-security/policies/content-security-policy/introduction/csp-directives" description="One page per directive, grouped by role: fetch, document, navigation, reporting, and more." />
</Cards>

## Start here [#start-here]

* New to CSP? Read [what CSP is](/en/docs/web-security/policies/content-security-policy/introduction/what-is-csp).
* Writing your first policy? Start from [`script-src`](/en/docs/web-security/policies/content-security-policy/directives/script-src) and [`default-src`](/en/docs/web-security/policies/content-security-policy/directives/default-src).
* Deploying safely? Ship [`Content-Security-Policy-Report-Only`](/en/docs/web-security/policies/content-security-policy/report-only) first and tighten from the reports.
* Checking a live policy? Run it through the [CSP evaluator](/tools/csp-evaluator).

## Reporting [#reporting]

Every blocked resource produces a
[csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation) naming
the directive that blocked it and the URL it blocked, delivered over the
[Reporting API](/en/docs/web-security/reporting-api). Those reports are how a policy is
built: ship it Report-Only, read what it would have blocked, and tighten. CentralCSP
collects and aggregates them per site, so a rollout is driven by what your visitors'
browsers actually observed rather than by guesswork.

## Sources [#sources]

* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C CSP editor's draft](https://w3c.github.io/webappsec-csp/)
* [MDN, Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy)
* [MDN, Content Security Policy guide](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP)