A mechanism (CSP) that restricts where scripts and other resources can load from, to prevent XSS and similar attacks.
Often abbreviated CSP. By only allowing resources to load from approved sources, it mitigates injection attacks such as XSS. Set via the Content-Security-Policy HTTP response header, it specifies which origins are allowed per resource type -- scripts, images, and so on -- letting the browser itself forcibly block an unintended external script, which is what sets it apart from relying on input validation alone.
© 2026 ITBGM