Inventory before you write
- Open your site with developer tools and list every domain in the Network tab.
- Note inline scripts and styles. Frameworks often inject them, which is why nonces or hashes matter.
- List frames you embed, such as payment or captcha widgets.
A starting policy
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://challenges.example; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'Directives worth setting even in a loose policy
- object-src 'none' removes an old plugin attack surface.
- base-uri 'self' stops injected base tags changing relative URLs.
- frame-ancestors controls who may embed your pages, replacing X-Frame-Options.
- form-action limits where forms can submit.
Move to enforcement
Read the reports for a week, add only sources you recognise, then rename the header to Content-Security-Policy. Avoid 'unsafe-inline' and 'unsafe-eval' in script-src where you can, since they remove most of the value.
Frequently asked questions
Can a CSP break my site?
Yes, which is why report-only mode exists. It logs violations without blocking anything.
Is a CSP a replacement for output encoding?
No. Fix the injection bug too. The CSP is a second layer.