← back to examples

default-src

Without CSP, injected scripts run freely. A default-src 'self' policy blocks them — click on search to see the difference.

CSP off CSP on
Response header
Content-Security-Policy: default-src 'self'
Search query
Result
( ._.)