In more detail
A policy such as default-src 'self' blocks anything loaded from elsewhere, which greatly limits the damage of a cross-site scripting (Cross-site scripting (XSS)) bug because injected scripts cannot run. Each directive covers one kind of resource (script-src, style-src, img-src, connect-src, frame-ancestors and others) and lists allowed sources: 'self', a domain, or a per-request nonce or hash. Inline scripts are blocked unless a nonce or hash allows them. Policies are usually rolled out first with the Content-Security-Policy-Report-Only header, which logs violations without blocking, and then enforced.
Why it matters
Too strict a policy silently breaks fonts, analytics or embedded videos; too loose a policy, such as 'unsafe-inline' in script-src, removes most of the protection. Blocked loads show up as errors in the browser console.
Example
Content-Security-Policy: default-src 'self'; img-src 'self' https://cdn.example.com; script-src 'self' 'nonce-r4nd0m'; frame-ancestors 'none'
Scripts run only from the site itself or when they carry nonce="r4nd0m", images may also come from cdn.example.com, and no other site may frame the page.
Common confusion
CORS lets a server share its responses with other origins; CSP restricts what a page may load and run.