What is Content Security Policy (CSP) and how do I implement it?
Content Security Policy (CSP) is an HTTP security header that tells browsers exactly which resources (scripts, styles, images, frames) are allowed to load on your page, preventing Cross-Site Scripting (XSS) attacks. Without CSP, if an attacker injects a script tag, it executes. With CSP, the browser only executes scripts from whitelisted sources. Add CSP header in .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google-analytics.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.yourdomain.com". Start in report-only mode to identify violations before blocking: Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report. CSP implementation takes 1-2 hours for a typical WordPress site but eliminates entire classes of XSS vulnerabilities. Test with CSP Evaluator from Google. Add security headers in Connect Quest cPanel .htaccess at connectquest.co.in.