{"id":"ia.csp","name":"Content-Security-Policy","verify":{"command":"curl -sI https://{domain}/","rescan":"isagentready results {domain} --checkpoint ia.csp","expect":"A Content-Security-Policy header"},"fix":{"steps":[{"action":"Start with a report-only policy and collect the violations.","order":1,"language":null,"code_example":null},{"action":"Send the enforced policy when the violations are fixed.","order":2,"language":"nginx","code_example":"add_header Content-Security-Policy \"default-src 'self'; script-src 'self'\" always;"}],"summary":"Send a Content-Security-Policy header with default-src and script-src.","skill":{"name":"security-trust","anchor":"ia.csp"}},"category":"security","aggregate":null,"references":[{"title":"MDN: Content Security Policy","kind":"guide","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"},{"title":"OWASP CSP Cheat Sheet","kind":"guide","url":"https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html"}],"stage":"read","lifecycle":{"introduced":"2026-08-24","revised":[],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"standard","evidence_source":{"title":"MDN: Content Security Policy","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"},"why":"Content-Security-Policy prevents XSS and injection attacks. For AI agents that interact with your site, CSP ensures the page content hasn't been tampered with by malicious scripts.","profiles":["browser_agent_usability","api_tool_readiness","agentic_commerce"],"score_role":"core","legacy_id":"5.4","i18n":{"nl":{"name":"Content-Security-Policy","steps":["Begin met een report-only-policy en verzamel de overtredingen.","Stuur de afgedwongen policy als de overtredingen zijn opgelost."],"why":"Content-Security-Policy voorkomt XSS- en injectie-aanvallen. Voor AI-agents zorgt CSP dat kwaadaardige scripts de pagina niet hebben aangepast.","fix_summary":"Stuur een Content-Security-Policy-header met default-src en script-src.","verify_expect":"Een Content-Security-Policy-header"}},"ar_practice_ids":[],"strength":"MUST","ar_mapping":"none","evidence_type":"recommendation","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.csp","maturity":"essential","applicability":{"mode":"always","condition":null,"surfaces":["website"]}}