What is CSP (Content-Security-Policy)

Where it helps a business

• The site must open under any access restrictions, without calling foreign services.
• Nobody should be able to slip a foreign script into the page and steal visitors' data.
• You need to show, provably, that the page goes nowhere else.

How we use it

On the museum complex website demo stand the default-src 'self' policy forbids the browser any foreign address. Fonts (24 families, 218 styles under a free licence), images, video and the map snapshot live on our server. An "External loads" button in the presentation panel counts requests right in the viewer's browser. nginx serves the CSP policy together with other security headers.

Common problems

• Analytics counters. External counters clash with a strict policy. On the demo the analytics counter runs in "showcase" mode and only writes events to the panel's log, while in live mode it stays silent until cookie consent; session replay is off because it records what is typed into form fields.
• Everything has to be hosted yourself. Fonts, maps and videos must live on your own server, and their size needs watching.

When you do not need it

A strict no-external-address policy is overkill if the site deliberately uses external services such as payments, maps or widgets. Then the allowed addresses are listed explicitly.