Evidence review
What to inspect before changing anything
Start with the delivered website and the real user journey. Record the current state so the team can distinguish an observed problem from an assumption and compare the same surface after deployment.
- 01Read the policy delivered on the main document
- 02Identify broad sources, unsafe-inline and unsafe-eval
- 03Map every allowed domain to a current product dependency
Implementation
A practical improvement plan
Make the smallest coherent change that solves the observed problem. Keep normal code review, accessibility, security and product checks in the loop instead of optimizing for the scan alone.
- 01Start with a Report-Only policy and collect violations
- 02Replace broad sources with explicit origins, nonces or hashes
- 03Enforce the tested policy and remove obsolete allowances
Verification
How to verify the result
Verification should test the intended outcome and the most likely regression. Use the production delivery path whenever headers, caching, rendering or third-party services affect the result.
- 01Confirm the header on production responses
- 02Exercise critical flows while checking violation reports
- 03Retest after every new third-party integration
Common pitfall
A shortcut to avoid
Copying a strict-looking policy from another site can break the product or leave dangerous exceptions that nobody owns.
Further reading
Primary guidance and references
These sources provide standards, security guidance or the interpretation framework used to keep this guide bounded. Product-specific implementation still requires review in the actual codebase.