Learn CSP properly.
Ten steps. About an hour. At the end you will have a real policy deployed in report-only mode on a real site, and you will know how to read what comes back.
Most CSP tutorials teach a host allowlist, which is the approach the specification and the research
both moved away from years ago. This one teaches what actually holds up: a per-response nonce,
'strict-dynamic', and the handful of directives everybody forgets.
The ten steps
- What CSP actually does3 min
- Deploy one today and break nothing5 min
- Read a violation report5 min
- The directives that matter6 min
- Why allowlists fail6 min
- Nonces and strict-dynamic7 min
- How nonces go wrong5 min
- Third parties and the real rollout6 min
- The four everyone forgets5 min
- Ship it5 min
Or start where you are
Something is broken →
Paste the console error and find out what your policy just blocked, and why.
Check a policy →
Paste a policy and get every weakness we can see, plus a stronger version.
Directive reference →
What each directive governs, what it does not inherit, and the usual mistake.
Watch an attack get blocked →
Four live demos, each served twice: once with no policy, once with one.