Does CSP work in all browsers?

CSP level 2 and 3 are supported by all current browsers. Older browsers may ignore it — which is why CSP is defense in depth, not the only control. Combined with proper output encoding and sanitization, CSP raises the bar substantially.

What is the difference between CSP and a WAF?

A WAF inspects traffic at the network edge and tries to block malicious requests. CSP is enforced by the browser against your page's own behavior. They're complementary: the WAF sees the attack arriving, CSP neutralizes it even if it gets through to the browser.

What Is Content Security Policy (CSP)?

Quick answer
CSP (Content Security Policy) is a response header that restricts what your page can load — scripts, styles, images, frames.
Its main job is stopping XSS: if inline or remote scripts are disallowed, injected script code can’t run.
Roll it out in report-only mode first, collect violations, then enforce — a strict policy that breaks your site is worse than none.

How does CSP stop XSS?

XSS works by getting the browser to execute attacker-controlled script. CSP gives the browser an allowlist of what it may execute: script-src ‘self’ means only scripts loaded from your own origin run; everything else — inline event handlers, javascript: URLs, scripts from other domains — is blocked with a console error. An injected