#Content Security Policy

Content Security Policy (CSP) is a browser security mechanism that controls which sources a web page may load content from. Articles tagged here explain its directives, from script-src and style-src to frame-ancestors and upgrade-insecure-requests. They show how CSP limits the damage of cross-site scripting and injected code. You will learn how to build a policy from a real inventory of your site’s scripts and services. The guides describe a report-only rollout that avoids breaking forms, analytics and payment widgets. Examples cover common CMS setups as well as custom websites.