What is the X-Webkit-CSP Security header in the browser ? What kind of attacks that we can mitigate from this ?

  • It's a legacy header for Content Security Policy from the times when it was still in early adoption phase. This header was used by Chrome for testing CSP. It's now almost completely abandoned - see webcookies.org/http-headers around 400 sites still use it as compared to over 10k for the standard CSP header.
    – kravietz
    Sep 18, 2017 at 8:03

1 Answer 1


This is a deprecated HTTP header and it is being replaced by the Content Security Policy header. This will prevent prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.

All the X-* policy headers are non standard headers and following headers are also deprecated and replaced by the CSP.




Ref : https://content-security-policy.com/


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .