Content Security Policy for XSS, clickjacking, and HTTPS

Content Security Policy (CSP) lets a site instruct the browser to restrict what its code may do, and its primary control is restricting the resources — especially JavaScript — a page can load, defending against cross-site scripting (XSS) attacks in which an attacker injects malicious code. CSP also protects against clickjacking: the frame-ancestors directive controls which documents, if any, may embed the page in a nested browsing context such as an iframe. The upgrade-insecure-requests directive makes the browser upgrade HTTP URLs to HTTPS for resource loads, same-origin navigation requests, and form submissions, though cross-origin top-level navigations are not upgraded. CSP can additionally enforce trusted types against client-side XSS. These protections are independent, so a site can deploy only the directives it needs. Deliver the policy in the Content-Security-Policy response header on all responses; a meta element with http-equiv is a useful option for a static client-side-rendered app without server infrastructure. A policy is a semicolon-separated list of directives: default-src 'self' sets a same-origin fallback for fetch directives not explicitly listed, and img-src governs image sources. Scope: Web security. Reviewed October 4, 2026.