Content Security Policy (CSP)

A Content Security Policy (CSP) is a rule your site sends to browsers that lists where scripts, styles and images on a page may come from. All else is blocked. It still helps when an attacker has found a way to place a malicious script on your site, because the browser refuses code from a source that is not on the list.

What is a Content Security Policy?

A CSP is a security headerAn HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor. that lists which sources of scripts, styles, images and other files a browser may load on a page.

A CSP is sent by your server as a response header, which is why it counts as one of the security headersSecurity headers are hidden instructions your site sends with each page that tell the visitor's browser which protections to switch on.. The value is a list of rules called directives. default-src sets the fallback for everything, script-src controls where scripts may come from, img-src does the same for images, and so on. Each directive holds the allowed sources, for example your own domainA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted. or a named external service.

The browser enforces the rules while it builds the page. That makes a CSP a second line of defense. It does not remove the weakness itself, but it can stop an injected script from running or from sending data to a stranger’s server.

What a CSP means for a PHP or WordPress site

The classic problem a CSP helps against is cross-site scriptingCross-site scripting (XSS) is an attack that sneaks a harmful script into one of your pages, so it runs in your visitors' browsers as if you had placed it., where an attacker gets their own script to run in your visitors’ browsers. On a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site with many plugins, there are plenty of places where that can go wrong, and a CSP reduces what a successful attempt can do.

The catch is that WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. is full of inline scripts, inline styles and files loaded from other domains. A strict policy blocks all of that unless you list it, so adding a CSP to an existing site is a project of testing and adjusting. A policy that is too loose gives little protection, and one that is too tight breaks forms, menus or tracking.

A static websiteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes. is a different starting point. With no PHP and no database running when a page is viewed, the page is a fixed set of files, and you can usually list exactly which sources it needs. That is one of the reasons we offer a WordPress to static site move as an option.

How to try a CSP safely

Browsers support a report-only mode through the Content-Security-Policy-Report-Only header. In that mode nothing is blocked, but the browser logs what the policy would have blocked. You can read those messages in the developer console.

A sensible order looks like this:

1. Check your current headers to see whether a CSP exists already.
2. Add a draft policy in report-only mode.
3. Browse your own site, including forms and checkout, and note every warning.
4. Add the sources you trust, remove the ones you do not need and repeat.
5. Switch to the enforcing header once the console stays quiet.

Test on a copy of the site, not on the live one, so a mistake does not reach visitors.

When to act

A CSP is worth adding when your site handles logins, payments or personal data, or when you have already had a script injected. It is not a substitute for updates: if the site runs on a version of PHP that no longer gets security fixes, the first step is moving to a supported release. A CSP is the layer you add after that.