Content-Security-Policy is an HTTP response header that tells the browser which sources of scripts, images, styles, frames, and other content are allowed to load. In practice, CSP acts as a browser-side allowlist: even if a page is compromised, the policy can block malicious scripts, injected iframes, and unwanted data exfiltration channels.
CSP matters because web attacks often depend on loading attacker-controlled code from a new domain or inline payloads inside a trusted page. Strong CSP can reduce the impact of cross-site scripting and plugin abuse, and it is also useful for defenders who want to limit third-party dependencies. In browser-layer attacks, such as when a malicious Service Worker interferes with responses, removing or weakening CSP can reopen the door for payload delivery. That is why teams should verify that CSP headers are still present, correctly enforced, and not being stripped or altered.