https://csp-guide.com/tags/static-sites/ Recent content in Static-Sites on CSP Guide Hugo -- gohugo.io en-us Tue, 07 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-static-sites-and-jekyll/ Tue, 07 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-static-sites-and-jekyll/ <p>Static sites have a nice security advantage: less moving parts, fewer server-side bugs, and usually a very predictable frontend. That predictability makes Content Security Policy a great fit.</p> <p>The catch is that CSP gets awkward fast when you mix a static build system like Jekyll with inline scripts, analytics tags, consent banners, and hosting platforms that don’t give you full control over headers. I’ve seen plenty of “we added CSP” rollouts that either broke production or quietly fell back to <code>'unsafe-inline'</code>, which defeats half the point.</p>