Security Required

Allow only the scripts you wrote

Send a strict Content Security Policy, a header that says which scripts may run. Allow scripts only by nonce or hash, with 'strict-dynamic', object-src 'none', base-uri 'none' and no unsafe-inline.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

On static pages, hash each inline script and style ('sha256-…'). Allow the bundle by its SRI hash, with 'strict-dynamic'. On dynamic pages, use a fresh nonce per request. Add default-src 'self', object-src 'none', base-uri 'none', frame-ancestors 'none' and report-to. Remove inline style= attributes and event handlers.

Example

Content-Security-Policy: default-src 'self';
  script-src 'sha256-AbC123...=' 'strict-dynamic';
  style-src 'self' 'sha256-XyZ789...=';
  object-src 'none'; base-uri 'none'; frame-ancestors 'none';
  upgrade-insecure-requests; report-to csp-endpoint

How to check

The console shows no violations. Google's CSP Evaluator reports no high-severity findings.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/content-security-policy.