HTTP headers / response header

Content-Security-Policy

Content-Security-Policy: default-src 'self'; img-src *

What it does

Declares which sources the browser may load scripts, styles, images and more from — the big anti-XSS control.

The gotcha

Deploy as Content-Security-Policy-Report-Only first; a strict CSP shipped blind breaks inline scripts and third-party embeds instantly.

Debugging headers on a phone

The fastest way to see what Content-Security-Policy is actually doing is to send the request and read both sides raw — ReqPad shows auto-generated and custom headers for every request, on all six protocols, with history. Related references: status codes · WWW-Authenticate · Content-Encoding · Transfer-Encoding · ETag · Last-Modified · Expires

Inspect Content-Security-Policy on a live request.

Build the request, send it, read raw headers and timing — from your iPhone. Free to start.

Download on the App Store