Content Security Policy is a new HTML5 technology that provides a novel approach to fixing XSS. With CSP, if you keep dynamic data and static code separate on your site, and the conforming browsers enforce the policy to ensure that the data never gets interpreted as code. The intricacies of the technology are in how CSP policies are combined and what limitations they place on web development. Although the first version of CSP wasn’t widely adopted, the new version brings features that should yield faster adoption rates and better protected websites. Several leading companies are successfully using CSP to protect their sites and monitor attack. What can we learn from these implementations?