Validate your CSP directives against Cross-Site Scripting (XSS) and code injection.
| Security Pillar | Status | Inspection Telemetry |
|---|
Content-Security-Policy restricts the domains from which scripts, styles, images, and fonts can load, rendering injected script payloads completely inert.Select your deployment environment below and copy the tailored configuration snippet to enforce compliance immediately:
# /etc/nginx/conf.d/csp.conf
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:;" always;CSP tells the browser which trusted sources of content are allowed to load and execute on your page, effectively blocking unauthorized malicious scripts and data exfiltration.
Using unsafe-inline allows any inline script tag to execute, which eliminates the core protection CSP provides against Cross-Site Scripting (XSS).
Transparent UK billing with isolated statement descriptors. Cancel anytime with 1 click.
Stop shipping exposed keys and missing headers in rapid AI builds.
The Retainer Justifier. Audit client sites, prove compliance, and automate remediation.
Statutory security armor for high-stakes regulated UK portals.
Authenticate to access your security workspace