https://csp-guide.com/tags/headless-cms/ Recent content in Headless-Cms on CSP Guide Hugo -- gohugo.io en-us Sat, 01 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-contentful-and-headless-cms-setups/ Sat, 01 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-contentful-and-headless-cms-setups/ <p>Headless CMS setups make CSP harder in a very specific way: your page looks static, but the browser is talking to half a dozen origins you forgot about.</p> <p>I’ve seen this pattern a lot with Contentful, Next.js, and marketing teams that add analytics, consent banners, preview mode, embedded videos, and rich text assets over time. The app starts simple. Then one day you flip on a strict CSP and half the site breaks.</p> https://csp-guide.com/posts/csp-for-sanity-io-and-headless-content/ Wed, 29 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-sanity-io-and-headless-content/ <p>If you use Sanity.io as a headless CMS, your CSP usually breaks in the same places:</p> <ul> <li>Sanity image CDN</li> <li>Sanity API requests</li> <li>live preview or draft content</li> <li>embedded content coming from editors</li> <li>Studio hosting on a separate origin</li> <li>frontend frameworks that sneak in inline scripts</li> </ul> <p>I’ve had to fix this more than once, and the main trap is assuming “headless” means your CSP can stay simple. It rarely does. Content comes from one place, images from another, previews from another, and editors eventually paste in a YouTube embed that blows up your policy.</p>