Content Security Policy tells the browser which content sources are allowed. Its strongest value is limiting what injected markup can execute, especially when scripts require nonces or hashes.
Start from the real page
List first-party scripts, styles, fonts, images, frames and connections. Remove unused third parties before writing directives; a policy should describe intentional dependencies.
Use report-only mode
Deploy Content-Security-Policy-Report-Only, collect violations and separate real requirements from browser extensions and noise. Then enforce gradually.
Avoid the weak shortcut
unsafe-inline allows broad inline execution and can remove much of CSP's XSS value. Prefer nonces or hashes and generate nonces per response.
Test complete journeys
Login, payment, media, consent tools and error pages may load different resources. CSP is a maintained control, not a one-time header copied from a scanner.
Reports may contain sensitive URLs
CSP violation reports can include document and blocked-resource addresses. Send them to a controlled endpoint, limit retention and avoid placing secrets in URLs. Sample high-volume noise rather than storing everything indefinitely.
Third-party scripts remain trusted code
Allowlisting a vendor permits its script under the policy. Review whether the integration is still required and use Subresource Integrity where appropriate; CSP cannot make a compromised allowed script harmless.
Handle policies and caching deliberately
A fresh nonce must match the header and authorized script elements in the same response. Avoid reusing nonces through cached HTML. Move inline event handlers into reviewed code where practical.
Use default-src 'self' as a restrictive starting point in report-only mode, then configure resource-specific directives from observed dependencies. This is not a complete strict CSP. Keep an enforced policy while testing stricter rules in report-only mode, and preserve a rollback to the previous known policy.
CSP is a mitigation, not a sanitizer. Continue context-aware output encoding, safe DOM APIs and dependency review. Retest the final response after CDN changes.
Continue with a worked exercise
Use the CSP debugging workshop to inspect a failure, test a repair and record the limits of the result.