# Which Sites have Content Security Policy to prevent XSS

**URL:** https://discuss.httparchive.org/t/which-sites-have-content-security-policy-to-prevent-xss/589
**Category:** Analysis
**Created:** [May 20, 2015, 11:10pm UTC](https://discuss.httparchive.org/t/which-sites-have-content-security-policy-to-prevent-xss/589 "2015-05-20T23:10:23Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![pganti](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/pganti/32/1299_2.png) [@pganti](https://discuss.httparchive.org/u/pganti)
#### Post date: [May 20, 2015, 11:10pm UTC](https://discuss.httparchive.org/t/which-sites-have-content-security-policy-to-prevent-xss/589/1 "2015-05-20T23:10:23Z")

</div>

I was interested in looking at the leaderboard for the sites that enable [content security policy](http://www.html5rocks.com/en/tutorials/security/content-security-policy/) which offers a certain protection from third party JS used to attack a first party site (like recent GitHub attack)

```
SELECT domain(url) as domainname, count(*) as num
FROM [httparchive:runs.latest_requests]
WHERE lower(respOtherHeaders) contains "content-security-policy" 
GROUP BY domainname 
ORDER BY num desc

```

which shows Twitter, Google and GitHub to be leaders (sadly expected to see more bigname properties also enable it…hint hint 😉

![](https://yyz1.discourse-cdn.com/flex035/uploads/httparchive/524/79d78c0736bff2ba.png)

![](https://yyz1.discourse-cdn.com/flex035/uploads/httparchive/525/c8301a170feed77f.png)

---

<div class="post-metadata">

### Author: ![cqueern](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/cqueern/32/2220_2.png) [@cqueern](https://discuss.httparchive.org/u/cqueern)
#### Post date: [May 22, 2015, 2:56pm UTC](https://discuss.httparchive.org/t/which-sites-have-content-security-policy-to-prevent-xss/589/2 "2015-05-22T14:56:50Z")

</div>

Awesome work, @pganti! Here’s a similar query I did in the past.

[http://bigqueri.es/t/how-many-resources-have-x-frame-options-strict-transport-security-or-content-security-policy-headers-for-web-app-security/155](http://bigqueri.es/t/how-many-resources-have-x-frame-options-strict-transport-security-or-content-security-policy-headers-for-web-app-security/155)

Looks like there’s been some decent adoption since then.

BTW, much of the work getting CSP in place at twitter and github is the work of Neil (@ndm).