What Is Content Security Policy?
LibraryA Content Security Policy (CSP) is a response header that whitelists where a page may load scripts, styles, images, frames and connections from. It is the main browser-side defence against cross-site scripting and data-injection and is increasingly required by compliance frameworks; implementing it well on a site that uses third-party tags is notoriously fiddly.
Detect Content Security Policy on any website:
Why Content Security Policy Matters
Libraries and third-party services are where a site's real behaviour lives: analytics, payments, auth, UI components and animation all arrive as scripts the browser can see. Knowing that Content Security Policy is on a page tells you about its dependencies, its privacy footprint, and sometimes its build pipeline — and it helps you tell template-driven stacks from hand-assembled ones. We've fingerprinted Content Security Policy on 30 live sites in our database, so the answers here are grounded in real scan data — not marketing copy.
Does Content Security Policy Mean a Site Was Built With AI?
Content Security Policy alone is not an AI signal.
A security header or protection is standard web tooling used by hand-coding developers and AI tools alike. It becomes weak supporting context only in combination with other evidence — for example a shadcn/ui + Supabase + Vite bundle that matches a known AI-builder export — and never counts as proof on its own.
How this feeds the score: builder fingerprints, bundle artifacts and AI-tool traces are weighed separately from stack context like frameworks, libraries and hosting. The full breakdown is on How scores work.
How Websites Using Content Security Policy Work
- `Content-Security-Policy` (or `-Report-Only`) header with directives like `script-src 'self' https://…`
- Nonces or hashes for inline scripts on well-configured sites
- Report endpoints (`report-uri` / `report-to`) for violation logging
- Indicates a security-conscious deployment; silent on how the site was built
Best Practices When Working With Content Security Policy
Based on patterns in our scan dataset and the detection evidence tiers.
- →Start by running a Content Security Policy detection scan on any URL you're evaluating — the 80+ signal engine returns a confidence score plus the exact markers it matched, which beats reading view-source by hand.
- →Cross-check the result against the full detection evidence in /how-scores-work — confidence tiers tell you whether a match is strong (headers + scripts) or circumstantial (a single HTML pattern).
How we detect Content Security Policy — see our methodology: AI Influence Score calculation, evidence tiers, and fingerprint signal types.
How Our Detector Identifies Content Security Policy
Our scanner analyzes multiple layers of a website's technical fingerprint to detect Content Security Policy usage.
- HTTP response headers: content-security-policy containing ".+" (high-confidence tier)
- Meta tags (generator, description, og:*) matching "http-equiv="Content-Security-Policy"" (medium-confidence tier)
- Signal weights for Content Security Policy: 95 points per high-tier match, 70 per medium, 40 per low — a site needs 60+ points before Content Security Policy is reported.
Websites Built With Content Security Policy
Real sites detected by our scanner
What Content Security Policy Sites Usually Run Alongside
Technologies detected on the same domains as Content Security Policy in our most recent scans. Counts are unique domains, not page views.
Frequently Asked Questions About Content Security Policy
What is Content Security Policy?+
A Content Security Policy (CSP) is a response header that whitelists where a page may load scripts, styles, images, frames and connections from. It is the main browser-side defence against cross-site scripting and data-injection and is increasingly required by compliance frameworks; implementing it well on a site that uses third-party tags is notoriously fiddly.
Does Content Security Policy mean a website was built with AI?+
Content Security Policy alone is not an AI signal. A security header or protection is standard web tooling used by hand-coding developers and AI tools alike. It becomes weak supporting context only in combination with other evidence — for example a shadcn/ui + Supabase + Vite bundle that matches a known AI-builder export — and never counts as proof on its own.
Why does Content Security Policy matter?+
Libraries and third-party services are where a site's real behaviour lives: analytics, payments, auth, UI components and animation all arrive as scripts the browser can see. Knowing that Content Security Policy is on a page tells you about its dependencies, its privacy footprint, and sometimes its build pipeline — and it helps you tell template-driven stacks from hand-assembled ones. We've fingerprinted Content Security Policy on 30 live sites in our database, so the answers here are grounded in real scan data — not marketing copy.
How do we detect Content Security Policy?+
Our scanner checks for these signals: HTTP response headers: content-security-policy containing ".+" (high-confidence tier); Meta tags (generator, description, og:*) matching "http-equiv="Content-Security-Policy"" (medium-confidence tier); Signal weights for Content Security Policy: 95 points per high-tier match, 70 per medium, 40 per low — a site needs 60+ points before Content Security Policy is reported.. Each match contributes to a confidence score, and the full evidence tiers are documented at /how-scores-work.
How many websites using Content Security Policy are in the database?+
We've fingerprinted 30+ live sites built with Content Security Policy across our scan dataset. The list refreshes as new scans come in.
What are the typical characteristics of a Content Security Policy website?+
`Content-Security-Policy` (or `-Report-Only`) header with directives like `script-src 'self' https://…`. Nonces or hashes for inline scripts on well-configured sites. Report endpoints (`report-uri` / `report-to`) for violation logging. Indicates a security-conscious deployment; silent on how the site was built
Related Tools & Technologies
Other libraries and services we detect
Ready to put Content Security Policy detection to work?
You now know what Content Security Policy is, why it matters, how to spot it, and where the detection signals come from. The next step is using that knowledge on a real URL — yours, a competitor's, or a prospect's.