---
id: django-csp
version: "4.0"
license: BSD
license_treatment: permissive
maintenance: aging
---

# django-csp — Django Content Security Policy support.

License: permissive · Maintenance: aging · Downloads: 4.0M/mo

## What it is and what it does

Django-CSP is a middleware package that automatically injects Content-Security-Policy headers into Django HTTP responses. It lets you define a security policy that tells browsers which origins are allowed to load scripts, stylesheets, images, and other resources, helping prevent cross-site scripting (XSS) and other injection attacks. The package wraps around Django and works with the packaging library to manage policy directives.

You configure policies in Django settings and the middleware applies them to all responses. It supports both report-only mode (for testing policies without enforcing them) and enforcement mode, and integrates cleanly into the Django request/response cycle without requiring changes to your views or templates.

Use it for:

- Prevent XSS attacks by restricting script execution to trusted origins only.
- Enforce HTTPS for all resources to block mixed-content vulnerabilities.
- Report policy violations to a logging endpoint for security monitoring.
- Gradually roll out stricter policies using report-only mode before enforcement.
- Isolate third-party widget code by restricting its access to the page DOM.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Django-CSP adds Content-Security-Policy headers to Django applications, enabling you to define and enforce browser security policies that control which resources can be loaded.

Yes. Django-CSP is a stable, low-friction way to add a critical security layer to Django applications. It has no known vulnerabilities, permissive licensing, and broad Django version support. The aging maintenance status is not a blocker—the package is mature and the 499-day release gap may reflect stability rather than abandonment. Install it if you need CSP header management in Django.

## Install

pip install django-csp
uv add django-csp
poetry add django-csp

## Installing django-csp

Before you install: Low install friction with only two runtime dependencies (django and packaging). Maintenance status is aging—last commit was 2025-11-14 and no release in 499 days—but the package is marked Production/Stable and remains actively used.

License in practice: BSD license is permissive, allowing commercial and private use with minimal restrictions; you may use and modify the package freely as long as you include the license notice.

Quickstart:

pip install django-csp

# In Django settings.py, add to MIDDLEWARE:
MIDDLEWARE = [
    'csp.middleware.CSPMiddleware',
]

# Define CSP policy:
CSP_DEFAULT_SRC = ("'self'",)
CSP_SCRIPT_SRC = ("'self'", "'unsafe-inline'")

Verify before relying:

- Whether the 499-day gap since last release indicates maintenance concerns or stable maturity for this use case.
- Compatibility with Django versions beyond 5.2 and Python versions beyond 3.13.

## Package facts

- License: BSD (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: aging
- Downloads: 4.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

django content security policy, csp headers django, browser security policy django, django security headers, content security policy middleware, security-headers, django-middleware

[View on SkillFed](https://skillfed.io/packages/django-csp) · [View on PyPI](https://pypi.org/project/django-csp/)