I'm trying to implement CSP on my site and after some research I saw that most of the sites don't implement it or the implementation is very weak.

I also see that the implementation of the CSP is similar to HSTS and you need to insert some CSP tags for its implementation.

So my questions are :

  • Is CSP a minimal requirement for security on web poages?
  • What is the impact of CSP on SEO?
  • "minimal requirement" based on what? You need to determine whether it is a minimum requirement for your situation.
    – user173641
    Feb 1, 2021 at 12:24
  • @J.J sorry i wasn't very clear... Is the CSP like a Best Practise for the security on Web Pages? i think that the question now can be less misunderstandable.
    – Ion Stirba
    Feb 1, 2021 at 13:09
  • I think these are the wrong questions. It is not about some CSP being a minimal requirement for security - but a strict CSP can mitigate common problems. Also, questions about impact on SEO are off-topic here since they don't address an information security problem. Feb 1, 2021 at 20:35

2 Answers 2


It is of course possible to run a secure website without having a Content-Security-Policy. There are, however, some reasons it makes sense:

  • First, if you configure it reasonably strictly, it's possible to make certain security problems, like cross-site scripting attacks, harder or nearly impossible. This does typically require eliminating inline scripts and restricting external scripts to load only from trusted domains.
  • If you host user-generated content, such as user-generated SVGs, you may want to avoid that content from being used as a source of scripts or a generalized attack platform. Since documents (including SVGs) loaded from a domain with a suitable CSP won't be able to use JavaScript, you may feel more comfortable hosting them.
  • You can also, more generally, require your pages to only function over HTTPS, since a robust CSP header will reject non-secure origins for loading external resources. Thus, a page accidentally loaded over HTTP would be devoid of images, scripts, and functional forms. While this would be a bad user experience, you'd at least avoid a lot of security problems in such a case.

I would say that now, in 2021, adding one is a best practice. Many sites do not, but because CSP headers do provide defense in depth for a wide variety of problems, it would be prudent to add one. I have no knowledge or interest in SEO and so couldn't speak to it, even it were on topic.


Content Security Policy (CSP) is much more than just XSS protection. CSP mitigates / eliminates the consequences of:

Therefore, you cannot create a secure web application without using a CSP.
CSP is de facto "Must Have", all Chrome and Firefox extensions / addons must have Content Security Policy.

What most of the sites don't implement it or the implementation is very weak it's mostly unknowingly and because of using third party libraries that require 'unsafe-inline'.

Not the answer you're looking for? Browse other questions tagged .