CSP (Content Security Policy)

An HTTP security header that defines allowed sources for loading scripts, styles, images, and other resources in a web page. CSP is the primary defense against XSS attacks by preventing execution of unapproved scripts. A poorly configured CSP (unsafe-inline, wildcards) provides little real protection.