<b>Content-Security-Policy Rollout SOP</b>
Use when adding CSP to a site that has none.
— Step 1: Inventory every external script, font, and analytics domain the site loads. CSP breaks what you forgot.
— Step 2: Start with <code>Content-Security-Policy-Report-Only</code> plus a <code>report-uri</code> endpoint. Break nothing yet.
— Step 3: Collect violation reports for a full week, including ad and tag-manager traffic.
— Step 4: Build the allowlist from real reports. Avoid <code>unsafe-inline</code>; use nonces or hashes for inline scripts.
— Step 5: Flip from report-only to enforced during low-traffic hours.
— Step 6: Keep the report endpoint live after enforcement to catch regressions from new plugins.
Run this every time.
Lockdown Ledger
@LockdownLedger
<b>Content-Security-Policy Rollout SOP</b>
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.