What does a CSP checker test?
A checker first verifies that the Content-Security-Policy header is actually returned with the page. It then examines the policy’s directives: default-src, script-src, style-src, img-src, connect-src, frame-ancestors, object-src, and base-uri are among the most consequential.
Presence alone is not enough. A policy can exist while still allowing unsafe script execution, arbitrary framing, or unrestricted third-party resources. Treat the scan as a configuration review, not a green checkbox.
Why is Content Security Policy important?
CSP limits where browsers may load scripts, styles, frames, images, and network connections. If an injection flaw reaches a page, a well-designed policy can stop the injected resource from executing or sending data elsewhere.
CSP is defense in depth rather than a substitute for output encoding, input validation, dependency updates, or secure application code. Its value is that it gives the browser an enforceable allowlist after your server has delivered the page.
How should I introduce CSP safely?
Start with Content-Security-Policy-Report-Only so violations are reported without breaking production behavior. Observe legitimate resource origins, remove obsolete dependencies, and tighten each directive before switching to enforcement.
Avoid copying a permissive policy that includes every domain seen in a report. Begin with default-src self, explicitly define necessary exceptions, disable object embedding, restrict base URLs, and use frame-ancestors to control who can embed the site.
Frequently asked questions
Can CSP prevent every XSS attack?
No. CSP can sharply reduce impact, but secure coding and output encoding remain essential. It is a defense-in-depth control.
Should I use a CSP meta tag or HTTP header?
Use the HTTP response header when possible. Meta-delivered policies support fewer capabilities and cannot provide every protection.
Does report-only mode protect visitors?
No. Report-only mode records violations but does not block them. Use it to prepare a policy before enforcement.