CSP Content Security Policy
HTTP header (or meta tag) that whitelists which resources the browser may load. Strong mitigation against XSS — even if attackers inject a script, it won't run if CSP is strict.
Directives: script-src, style-src, img-src, connect-src, frame-ancestors, etc. Modern best practice: script-src 'strict-dynamic' 'nonce-XYZ' — only scripts with the matching nonce may run. report-uri collects CSP violations. Common mistake: forgetting to hash inline script + style. CSP3 (2023+) refines features. Mozilla Observatory + securityheaders.com grade deployment.