Content Security Policy (CSP)
PCIComplianceHubLast updated
An HTTP response header telling the browser which sources it may load and execute scripts, styles, frames and other resources from, and which it must block. On a payment page it limits what an injected script can do: a script-src allow list stops code executing from a host the merchant never authorised, and a connect-src allow list stops a script that does execute from posting card data to an attacker endpoint. PCI DSS does not name CSP, but it is one of the common ways of meeting the authorisation and integrity expectations of Requirements 6.4.3 and 11.6.1.
Applies to. Any site that serves a payment page or wraps a provider's embedded form. It is a browser mechanism the site controls through a response header or meta element, not a PCI DSS requirement in itself.
Example. A policy of script-src 'self' plus the provider's script host, connect-src 'self' plus the provider's API host, and frame-src limited to the provider's payment host stops a script injected from anywhere else from running, and stops a running script from posting form data to a host that is not listed. Adding report-to or report-uri makes the browser report what it blocked, which the 11.6.1 guidance lists as one change-detection technique.
Limits. A policy that allows 'unsafe-inline', a whole CDN, or a tag manager permits whatever those sources deliver, so it is only as narrow as its loosest directive. It prevents and reports; it keeps no inventory and no justification, so it satisfies part of 6.4.3 at most. The policy is itself something 11.6.1 should watch: the guidance notes that changes to the CSP can indicate tampering, since weakening it is a way to disable the protection.