Implementing Content Security Policy Headers in PHP

Send a restrictive Content-Security-Policy response header that limits the origins of scripts, styles and other browser resources.

The examples introduce the underlying control before showing a verification and an application-level safeguard.

What You Will Build

Send a restrictive Content-Security-Policy response header that limits the origins of scripts, styles and other browser resources.

Prerequisites

Use PHP 8.4 or newer, HTTPS for all authentication operations, and an application session or database where required. Example configuration values are placeholders, never production secrets.

Example 1: Basic Operation

Create a response-specific CSP nonce and use it in both header and script.

<?php
$nonce = rtrim(strtr(base64_encode(random_bytes(16)), '+/', '-_'), '=');
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{$nonce}'; object-src 'none'; base-uri 'self'");
echo '<script nonce="' . htmlspecialchars($nonce, ENT_QUOTES, 'UTF-8') . '">console.log("Ready")</script>';

Example 2: A Different Use Case

Apply baseline response security headers without using unsafe-inline.

<?php
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: strict-origin-when-cross-origin');
header("Content-Security-Policy: default-src 'self'; object-src 'none'; frame-ancestors 'none'");

Practical Example: Checking the Result

Protect authentication cookies and sensitive pages alongside CSP.

<?php
session_set_cookie_params(['secure' => true, 'httponly' => true, 'samesite' => 'Lax']);
// Call before session_start(), under HTTPS.
header('Cache-Control: no-store');

Important Behavior and Edge Cases

A nonce applies to the exact inline script on that response; do not use a fixed nonce or combine strict policy with unsafe-inline.

Enforce controls on the server, test denial paths and do not assume that a snippet alone implements an entire production workflow.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• Send a restrictive Content-Security-Policy response header that limits the origins of scripts, styles and other browser resources.
• A nonce applies to the exact inline script on that response; do not use a fixed nonce or combine strict policy with unsafe-inline.
• CSP limits XSS impact but does not replace context-correct output encoding.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.