CSP (Content Security Policy)
Your site's instructions to the browser about which scripts, styles and frames it may load, so injected code has nowhere to run.
Updated October 2026 · with examples from our own builds
What does CSP mean in practice?
A Content Security Policy tells the browser where a page's scripts and other resources may come from and what they may do, such as never evaluating strings as code. If an attacker manages to inject a script, a strict policy stops the browser running it, which makes CSP one of the strongest defences against cross-site scripting (XSS).
It bites hardest when your code runs on other people's sites: embedded forms, chat widgets, booking buttons. Those sites often have strict policies, and a widget that relies on eval simply won't run there.
Strict policies take work. Inline scripts need nonces, third-party scripts need listing, and some libraries have to be replaced.
CSP at a glance
- Blocks
- Injected scripts and unexpected resources
- Matters most for
- Widgets embedded on customers' sites
- Cost
- Removing eval and inline scripts from the code
Where has CSP come up in our builds?
Form conditions and calculations run on a hand-written expression parser of about 170 lines instead of eval, the embed widget renders inside a Shadow DOM, and hosted pages send default-src 'none', nonce-only scripts, no unsafe-eval and frame-ancestors built from the workspace's registered domains. A regression test throws nine XSS payloads at every control.
HTML email opened in the admin panel's webmail renders in a sandboxed frame.
Common questions about CSP
Why won't my widget load on a customer's website?
Often the site's Content Security Policy forbids something the widget does, such as loading a script from an unlisted domain or evaluating code. Widgets built without eval, like AskForth's embed, can run under strict policies.
Does a Content Security Policy slow a site down?
No. It is a header the browser reads once; the effort goes into making the site's own code comply.
Related terms
Sources
Planning a product and not sure where CSP fits? Ask us, or browse all 116 terms in the glossary.