# CSP Academy

> Learn Content Security Policy properly.

An independent Content Security Policy resource, sponsored by Report URI. No sign-up, no
paywall, no tracking. Content is CC BY 4.0 — reuse it freely with attribution.

Append `.md` to any URL below for clean Markdown of that page.

## Pages

- [CSP Academy](https://csp.academy/index.md)
- [about](https://csp.academy/about.md)
- [directives/base-uri](https://csp.academy/directives/base-uri.md)
- [policy](https://csp.academy/policy.md)
- [start](https://csp.academy/start.md)
- [start/1](https://csp.academy/start/1.md)
- [start/10](https://csp.academy/start/10.md)
- [start/2](https://csp.academy/start/2.md)
- [start/3](https://csp.academy/start/3.md)
- [start/4](https://csp.academy/start/4.md)
- [start/5](https://csp.academy/start/5.md)
- [start/6](https://csp.academy/start/6.md)
- [start/7](https://csp.academy/start/7.md)
- [start/8](https://csp.academy/start/8.md)
- [start/9](https://csp.academy/start/9.md)

## The other two sites

- [CSP Academy](https://csp.academy/llms.txt) — learning CSP from scratch
- [CSP Fail](https://csp.fail/llms.txt) — diagnosing a CSP error
- [CSP Win](https://csp.win/llms.txt) — checking whether a policy is any good

## Machine-readable data

- [https://csp.academy/api/directives.json](https://csp.academy/api/directives.json) — every CSP directive: what it governs, whether it inherits from `default-src`,
  the recommended value, and the usual mistake