rjaWebsWhat a Content Security Policy is
A Content Security Policy (CSP) is a set of rules a website can hand to the browser that says, in effect, "only load scripts, styles, and images from these approved places." It's a published standard, maintained by the W3C and understood by every modern browser. The appeal is that it works as a backstop: even if something slips past another defence, the browser keeps its own independent list of what's permitted and simply won't run anything that isn't on it. It's the digital equivalent of a guest list on the door — the bouncer doesn't have to understand the whole party, only whether a name is on the list.
The attacks it's built to blunt
The main target is a broad, common family of attacks called cross-site scripting, where a bad actor manages to sneak their own code onto your page — often through something as ordinary as a comment box, an out-of-date plugin, or a compromised third-party widget. Once that code runs, it can quietly read what visitors type, redirect them elsewhere, or skim payment details. A well-written policy means the injected code isn't on the approved list, so the browser refuses to run it. A related setting can also stop your site being secretly framed inside another to trick people into clicking things they didn't mean to — a trick known as clickjacking.
Where it fits, and where it doesn't
A CSP is a layer, not a cure. It earns its keep most on sites that handle logins, payments, or content submitted by users, and it has to be written with care: too loose and it protects nothing, too strict and it can break the very features you were trying to protect. It also doesn't replace the fundamentals — keeping software updated, vetting any third-party code, and serving everything over secure HTTPS. It's a genuinely useful tool that we weigh, alongside other measures, against what a particular site actually needs to protect — not a box every brochure site needs ticked.