https://csp-guide.com/tags/codepen/ Recent content in Codepen on CSP Guide Hugo -- gohugo.io en-us Sun, 02 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-codepen-embeds/ Sun, 02 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-codepen-embeds/ <p>CodePen embeds look harmless until your CSP starts blocking them.</p> <p>That usually happens the first time you paste CodePen’s embed script into a site with a reasonably locked-down policy. Suddenly the pen doesn’t render, the console fills with CSP violations, and you’re stuck deciding whether to weaken your policy or drop the embed.</p> <p>I’ve had to make this tradeoff a few times. The short version: if you want CodePen on a production site, the safest path is almost always the iframe embed, not the JavaScript embed. The rest of the guide is about why.</p>