A Content Security Policy (CSP) is a security mechanism designed to protect websites and web applications from common threats like cross-site scripting (XSS) and data injection attacks. It works by allowing IT administrators to define a set of rules that specify which content sources are trusted and permitted to load on a web page. These rules control the loading of scripts, styles, images, and other resources through HTTP headers or meta tags, preventing unauthorized or malicious content from being executed. By enforcing these restrictions, CSP enhances the overall security of web applications and reduces the risk of exploitation by attackers.