Blog

What Microsoft's Entra ID Lockdown Tells Us About CSP in Practice

Microsoft is enforcing CSP on Entra ID sign-in pages from October 2026 to block script injection. Here's what it means for your own CSP strategy.

Blog

CSP Level 3 in Practice: What Changed From CSP2 and What to Check in Your Policy

CSP Level 3 is still a Working Draft, but much of it already ships in browsers. Here is what it changes about reporting, workers, strict-dynamic and hashes, and what to check in your policy.

Blog

The CDN You Trust Might Not Be Yours Anymore

Most Content Security Policy audits focus on what a script does. A quieter risk is who still owns the domain it's coming from, and a story that surfaced this month is a reminder that the answer can change without anyone touching your code.

CSP

Using CSP Violation Trends to Detect Suspicious Website Activity

Learn how to analyse CSP violation reports and trends to detect suspicious website activity, investigate threats, and strengthen web security.

CSP

The CAPTCHA That Wasn't: What the ClickFix Website Hijacking Wave Reveals About Missing CSP

A ClickFix campaign hijacked thousands of sites this week. See why a proper Content Security Policy would have blocked it and how to check yours.