What is the purpose of a Content Security Policy?
- A To compress responses
- B To restrict which sources of scripts, styles and other resources the browser will load and execute
- C To enforce HTTPS
- D To cache assets
Answer
To restrict which sources of scripts, styles and other resources the browser will load and execute
CSP is a strong defence against XSS. Even if a payload is injected, the policy can prevent inline or third-party scripts from executing.





