[{"data":1,"prerenderedAt":146},["ShallowReactive",2],{"publication:en:P155":3},{"meta":4,"copy":16,"relatedArticles":132,"terms":133,"term":134,"resourceParent":140,"glossaryParent":143},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P155","\u002Fglossary\u002Fcsp","term","what is CSP","What is CSP? Content Security Policy, reporting and enforcement","What is CSP? Content Security Policy explained","Understand Content Security Policy and its limits. Distinguish reporting from enforcement and plan a policy around real website resources and functions.",[13,14],"\u002Fservices\u002Fsecurity-audit","\u002Fservices\u002Fcloudflare","2026-10-30",{"intro":17,"sections":18,"checklist":89,"faq":95,"links":105,"sources":125,"cta":127},"CSP (Content Security Policy) is a browser-enforced policy that can restrict resources and behaviors allowed for a web document. A report-only policy observes violations without enforcing those restrictions. CSP can add a defensive layer, but it does not replace fixing unsafe code, authentication or server-side controls. Build and verify the policy around the website’s actual resources and business functions.",[19,28,66,71,79,84],{"title":20,"paragraphs":21,"sources":24},"Connect the policy to the document and its required resources",[22,23],"Content Security Policy tells the browser which specified behaviors or resource sources the document permits. The relevant rules depend on what the site actually uses, such as scripts, images, frames and outgoing browser connections. MDN describes the policy mechanism and its deployment modes. The important business question is which resources are required and who can approve changes to that list.","Start with a resource inventory rather than a copied header from another website. A checkout, map, analytics integration and contact widget can have different dependencies. Record their purpose and owner so a blocked resource can be assessed against a real requirement. A resource being widely used is not enough to authorize it on this site, and an unfamiliar name is not automatically evidence of an attack.",[25],{"label":26,"url":27},"MDN: Content Security Policy, reporting and enforcement","https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FGuides\u002FCSP",{"title":29,"paragraphs":30,"sources":33,"table":35},"Distinguish reporting, enforcement and functional acceptance",[31,32],"A report-only policy and an enforced policy answer different questions. MDN states that report-only generates violation reports without enforcing the policy, while an enforced policy applies its restrictions. The two can coexist during a controlled revision. A header check that finds a policy name therefore cannot by itself establish which behavior is actually blocked for visitors.","Our policy acceptance register records the delivery mode and the tested business behavior. It does not generate a universal header or award a security score. Keep the actual response and browser behavior tied to the tested release and route. If a policy is still being observed, say so explicitly rather than describing it as an enforced protection in a handoff or sales claim.",[34],{"label":26,"url":27},{"caption":36,"headers":37,"rows":41},"CSP resource and policy-mode acceptance register",[38,39,40],"Review item","Evidence to retain","Acceptance question",[42,46,50,54,58,62],[43,44,45],"Business resource","Purpose, source and responsible owner.","Is this resource actually required?",[47,48,49],"Policy delivery","Observed response and applicable route.","Which policy reaches the browser?",[51,52,53],"Mode","Reporting, enforcement or both.","Which restrictions are active?",[55,56,57],"Functional check","Controlled form, login or checkout result.","Does the intended workflow still work?",[59,60,61],"Reported violation","Relevant context with restricted evidence access.","Is it a required dependency, unwanted source or unresolved case?",[63,64,65],"Change ownership","Approved revision and rollback plan.","Who reviews the next integration change?",{"title":67,"paragraphs":68},"Treat a violation report as evidence to interpret",[69,70],"A reported violation describes behavior observed against the policy; it is not automatically proof of a successful attack. The policy may omit a required dependency, a page may differ from the tested route or an unrelated client-side condition may affect the observation. Assign an owner to interpret the relevant report rather than broadening the policy whenever a new source appears.","Reporting also needs an appropriate collection and retention process. URLs and other context can carry sensitive information, so restrict access and avoid unnecessary copies in public tickets. Record the minimum evidence needed to resolve the question. A reporting endpoint with no owner or an unread queue does not become a useful security process simply because the policy can send data to it.",{"title":72,"paragraphs":73,"example":76},"Repair unsafe behavior instead of using the policy as a substitute",[74,75],"CSP should reinforce the intended website behavior, not justify leaving an unsafe rendering or authorization path unfixed. If a page accepts content that can become unwanted browser code, the relevant application handling still needs repair. Keep the browser policy, server response, account controls and integration permissions in their own scopes so each owner understands what their work establishes.","A WAF configuration and a CSP header also operate at different boundaries. One cannot be assumed to compensate for every weakness in the other. If an assessment only checks the header's presence, label that limited observation accurately. A meaningful acceptance includes the active policy, selected routes, expected workflows and the remaining untested behavior rather than a claim that adding one header secured the whole website.",{"title":77,"text":78},"Illustrative example: a map stops loading","A fictional site introduces a proposed policy and a map no longer loads in the controlled test. The team identifies the map integration owner and verifies which resource is genuinely required before revising the policy. It does not allow every source to remove the error. This is an illustrative review decision, not a policy deployed or tested on a customer site.",{"title":80,"paragraphs":81},"Plan a controlled transition and a recoverable change",[82,83],"Choose representative routes and functions with the business owner before enforcing a new policy. Use controlled test data and supported sandbox paths where transactions or messages are involved. Document the difference between the test environment and production, the policy revision and the criteria for acceptance. A successful home-page render does not verify every form, login or checkout path.","Keep a rollback route for an unintended restriction, with a named person who can authorize it. The aim is to restore intended function without silently removing the protection or leaving a broad temporary exception forever. If enforcement is deferred, record the reason and the next review owner. Do not present an observation-only stage as though that acceptance decision has already been completed.",{"title":85,"paragraphs":86},"Maintain the policy alongside the website",[87,88],"Add CSP review to the release process when a developer introduces a new script, embedded service or browser connection. Keep the dependency inventory and approved exceptions current. This makes a later change understandable to a replacement administrator and reduces pressure to apply a broad allowance just to clear a console error. Recheck the relevant behavior after changes in delivery, caching or edge configuration.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli website and digital-infrastructure knowledge. Our scoped security and configuration work can address the actual website policy and its dependencies. We do not promise that a CSP prevents every attack or that a header score proves full protection. Describe the required workflows so the review and acceptance can be agreed accurately.",[90,91,92,93,94],"Inventory the resources and functions the site actually requires.","Record policy delivery and whether restrictions are enforced.","Assign an owner and restricted handling for relevant reports.","Test representative workflows with controlled data.","Keep exceptions, rollback and future resource changes owned.",[96,99,102],{"question":97,"answer":98},"Does CSP report-only block unwanted scripts?","No, it reports violations without enforcing that policy. Confirm which enforced policy, if any, is actually delivered.",{"question":100,"answer":101},"Can I copy the same CSP header to every website?","A useful policy must match the site’s resources, implementation and accepted functions. A generic header can break legitimate work or offer less restriction than expected.",{"question":103,"answer":104},"Does a CSP replace fixing XSS?","No: repair unsafe application behavior and treat CSP as an additional layer with its own scope and acceptance checks.",[106,109,112,115,118,120,122],{"path":107,"label":108},"\u002Fblog\u002Fsecurity-headers-explained","Plan headers around actual website functions",{"path":110,"label":111},"\u002Fglossary\u002Fxss","Understand browser script-injection risks",{"path":113,"label":114},"\u002Fglossary\u002Fssrf","Separate server-side request controls",{"path":116,"label":117},"\u002Fblog\u002Fhttp-security-score-limits","Understand the limits of header scores",{"path":13,"label":119},"Scope a website security review",{"path":14,"label":121},"Review edge configuration responsibilities",{"path":123,"label":124},"\u002Fblog\u002Fthird-party-script-data-flow","Review the information flows of allowed website scripts",[126],{"label":26,"url":27},{"title":128,"description":129,"button":130,"type":131},"Review the policy against real website functions","Describe the site and affected workflow without submitting private report URLs or sensitive customer data in the initial form.","Discuss the browser-policy review","check",[],[],{"name":135,"aliases":136},"CSP (Content Security Policy)",[137,138,139],"Content Security Policy","browser resource policy","CSP report-only",{"path":141,"label":142},"\u002Fresources","Website security resources and templates",{"path":144,"label":145},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134057993]