Content-Security-Policy

Content-Security-Policy: default-src 'self'; img-src 'self' data:

What it does

The allowlist of what the page may load and run. The strongest XSS mitigation there is, and the easiest header to break your own site with.

In practice

CSP failures are silent by default: the resource just does not load, and only the console knows. Roll it out with Content-Security-Policy-Report-Only first, watch the violation reports, then enforce. The analytics-never-arrived class of bug is very often a CSP that predates the analytics script.

← All headers