← The ten steps · Step 10 of 10 · 5 minutes

Ship it

Everything from the last nine steps, on one page, in the order you should do it.

The policy

Content-Security-Policy-Report-Only:
  default-src 'self';
  script-src 'nonce-{RANDOM}' 'strict-dynamic';
  style-src 'self';
  img-src 'self';
  connect-src 'self';
  object-src 'none';
  base-uri 'none';
  form-action 'self';
  frame-ancestors 'none';
  report-uri <your endpoint>

{RANDOM} is at least 128 bits from your platform's secure random source, generated fresh on every response, placed on every script tag you render. The response carrying it must be Cache-Control: no-store.

The order

1. Report-only, strict, everywhere. It cannot break anything, so there is no reason to roll it out gradually.
2. Wait a week. A full business cycle, including the traffic you do not think about.
3. Triage. Discard extension noise. Everything left is a real finding.
4. Fix by nonce-ing, not by allowlisting. Widen img-src, style-src and connect-src as needed; resist widening script-src.
5. Enforce. Move the policy to Content-Security-Policy and put your next tightening into report-only behind it.

What to watch afterwards

• Report volume over time. A spike means someone shipped something. That is worth knowing the same day.
• New origins. Every one is a third party that appeared on your site without going through you.
• The length of script-src. If it only ever grows, the policy is decaying.
• Your nonce. Two curls, occasionally. Caching layers get added by people who do not know what a nonce is.

How you know you are done

You are not, and that is the correct state. A CSP is not a project with an end date; it is a control that reflects what your site loads, and your site changes. "Done" looks like: an enforced strict policy, a report-only policy one notch tighter behind it, reports going somewhere a human occasionally reads, and someone who notices when the volume changes.

If you only do three things

1. Deploy Content-Security-Policy-Report-Only today. It cannot break anything.
2. Add base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'. Four lines, four real attacks, no rollout required.
3. Get the reports somewhere you will actually look.

Where to go next