Inventory the resources
List the domains providing scripts, styles, images, fonts and frames. Include CAPTCHA, sign-in and WebSocket connections. Pasting a restrictive policy can break a working flow without fixing the underlying vulnerability. CSP is an additional layer, not a substitute for safe HTML generation.
Observe before enforcing
This header illustrates a testing policy, not a universal drop-in configuration. Adapt it to your application. Report-Only produces violation reports without blocking the actions; the presence of this header does not establish enforcement.
Content-Security-Policy-Report-Only: default-src 'self'; object-src 'none'; base-uri 'self'Inspect console messages and, when configured, the reporting system. Reports may contain page and resource addresses. If stored, restrict the data, access and retention and reflect actual handling in the privacy information.
Test workflows, not just the home page
- Sign-in, sign-out and additional account checks.
- Forms, error messages and CAPTCHA.
- Embedded content, downloads and application connections.
- PL/EN, both themes and mobile layouts.
After investigating violations, roll out an enforced Content-Security-Policy in stages. If using a nonce, generate it appropriately for each response and match it to the scripts. A single fixed nonce copied into every document does not provide the intended protection.
Choose other headers separately
X-Content-Type-Options: nosniff supports enforcing declared content types, so verify MIME configuration. HSTS requires working HTTPS; a long lifetime, subdomain coverage and preload have effects beyond one page test. Check framing and permissions policies against the integrations you use, and retain a controlled rollback path.
Sources and documentation
Source links are retained for checking dates, availability and original context.