What is Content-Security-Policy?

Also called CSP.

A Content-Security-Policy is a rule your website sends to the browser listing which scripts, styles and images are allowed to load. Anything not on the list is blocked, so a script an attacker manages to inject never runs.

In more detail

It is sent as a response header, before the page itself. The browser reads it and enforces it for that page — you are not trusting your own code to be safe, you are telling the browser what to refuse regardless. Policies are usually built up gradually: you start in report-only mode, which reports violations without blocking anything, watch for a week to see what your real pages actually load, and only then enforce it.

Why it matters for your site

It is the difference between an injected script being a serious incident and being blocked automatically. Deploying one in enforcing mode without watching first is the usual way people break their own checkout, which is why report-only exists.