Articles tagged content security policy

July 18, 2026HeaderTest Team

How to Add a Content Security Policy to a Next.js App

Next.js emits inline hydration scripts, so a naive script-src blocks your own app. Here is the clean nonce + strict-dynamic setup in middleware, plus the styled-jsx and next/image gotchas.

February 15, 2026HeaderTest Team

HeaderTest Out of Beta: New Scoring and Domain History

HeaderTest is out of beta. Here's what changed: a new three-category scoring system, domain history pages with score trends, and a more accurate analysis engine.

February 8, 2026HeaderTest Team

Next.js + Sanity CMS: CSP Gap and Image Proxy Risk

A lot of Next.js sites using Sanity CMS ship with no CSP at all. Worse, the _next/image endpoint can become an open image proxy for cdn.sanity.io. Here's what's happening and how to lock it down.

January 13, 2026HeaderTest Team

What is Content Security Policy (CSP)? Complete Guide

A practical walkthrough of Content Security Policy — what it actually does, how browsers enforce it, and how to roll one out without breaking your site.

January 10, 2026HeaderTest Team

Top 10 CSP Mistakes Developers Make (And How to Fix Them)

We scan thousands of CSP headers. These are the mistakes that come up over and over — and they're all fixable.