CSP
A Content-Security-Policy is a header declaring which sources a page may load resources from.
Why it matters
It is the main defence against injected script, and a missing CSP is the most common gap on otherwise well-built sites.
How it is measured
Fetch the site headers and read Content-Security-Policy. Confirm object-src none, base-uri self and a constrained form-action.
Checks that involve csp
Related terms
Questions
What is csp?
A Content-Security-Policy is a header declaring which sources a page may load resources from.
Why does csp matter?
It is the main defence against injected script, and a missing CSP is the most common gap on otherwise well-built sites.
How is csp measured?
Fetch the site headers and read Content-Security-Policy. Confirm object-src none, base-uri self and a constrained form-action.