Content Security Policy (CSP) restricts resource sources and code execution in the browser. On a Joomla website, a suitable policy can reduce the impact of some attacks, including XSS.
How a policy is delivered
The main delivery mechanism is the Content-Security-Policy HTTP header. Directives control resource categories: script-src covers scripts, style-src covers styles and img-src covers images. The default-src directive provides a fallback for many resource directives.
A hash or nonce can authorise a particular inline script. A nonce is an unpredictable value generated for a response. Broad permissions such as unsafe-inline weaken restrictions. Multiple policies are enforced together rather than merging their permissions into one permissive list.
Deployment in Joomla
For Joomla, inventory the resources used by the template, editor, forms and external integrations. An untested strict policy can break navigation, payments or the administrator interface. Test it on a separate copy first.
The Content-Security-Policy-Report-Only header allows observation without blocking under that policy. Test the main Joomla journeys and review browser messages and reports. Enforcing the policy requires checking the affected pages separately.
Limits of CSP
CSP does not repair unsafe HTML output or replace updates and permission checks. It is an additional layer that needs maintenance as extensions and integrations change.
Conclusion
A useful CSP matches the resources and tested user journeys. An untested generic header can disrupt a Joomla website.