// http header · security header
Content-Security-Policy
Restrict where resources may load from
What the Content-Security-Policy header does
Content-Security-Policy (CSP) restricts where the page may load resources from — scripts, styles, images, and more — which is one of the strongest defences against cross-site scripting (XSS). default-src 'self' limits everything to the same origin unless overridden.
Example
Content-Security-Policy: default-src 'self'Where it's used
Content-Security-Policy is a security header. Security headers tell the browser to turn on protections against common web attacks.
Other security headers
Strict-Transport-Security Content-Security-Policy X-Content-Type-Options X-Frame-Options Referrer-Policy Permissions-Policy