CSP

Content Security Policy - an HTTP header that controls which resources a browser is allowed to load for a given page.

May 1, 2026 / About 1 min read

Security

Content Security Policy (CSP) is a security mechanism implemented through an HTTP response header that allows website owners to control which resources (scripts, styles, images, fonts, etc.) the browser is permitted to load. CSP is a powerful defense against cross-site scripting (XSS) and data injection attacks.

A CSP header contains directives that specify allowed sources for different resource types. For example, script-src defines where JavaScript can be loaded from, style-src controls CSS sources, and img-src governs image sources. The default-src directive provides a fallback for any resource type not explicitly configured.

For URL shortening services, CSP helps protect splash pages, preview pages, and the management dashboard from XSS attacks. A well-configured CSP prevents attackers from injecting malicious scripts even if they find an input validation vulnerability.

Implementing CSP can be challenging because overly restrictive policies may break legitimate functionality. The recommended approach is to start with a report-only mode (Content-Security-Policy-Report-Only) that logs violations without blocking resources, then gradually tighten the policy based on the reports.

Was this article helpful?

Related Terms

CORS

Cross-Origin Resource Sharing - a browser security mechanism that controls which domains can access resources from another domain.

XSS

Short for Cross-Site Scripting. An attack technique that injects malicious scripts into web pages to steal users' information.

Clickjacking

An attack that tricks users into clicking on hidden elements by overlaying transparent frames on top of legitimate web pages.

X-Frame-Options

An HTTP response header that controls whether a browser should allow a page to be displayed in an iframe.

Input Validation

The process of verifying whether input data from users matches the expected format and range. One of the security measures.

Content Security Policy

An HTTP header that restricts the origins from which a web page can load resources. A defense layer that mitigates XSS attacks and data injection.

Short URL Security - Phishing Risks, Safe Sharing Practices, and Protection Guide

A comprehensive guide to short URL security. Understand phishing risks, malware distribution via shortened links, and best practices for safe sharing.

Self-Hosting a URL Shortener: Full Link Control

Explore the benefits and challenges of running your own URL shortening service. Covers open-source tools, serverless architecture, and cost-performance tips.

Click Fraud Prevention: Protect Short URLs from Bots

Understand click fraud tactics and learn how to defend your short URLs. Covers bot detection, rate limiting, CAPTCHA strategies, and anomaly detection.

FAQ

What types of attacks does CSP prevent?

CSP prevents XSS (Cross-Site Scripting), data injection, and clickjacking attacks by restricting resource loading to only permitted sources.

How do I configure CSP?

Set it via the Content-Security-Policy HTTP response header or an HTML <meta> tag. It's recommended to test with Content-Security-Policy-Report-Only first before applying in production.

Put the terms to work

Shorten a URL for Free