My Blog Now Has a Content Security Policy - Here's How I've Done It
Troy Hunt
FEBRUARY 1, 2018
However, you can add a CSP via meta tag and indeed that's what I originally did with the upgrade-insecure-requests implementation I mentioned earlier when I fixed the Disqus issue. However - and this is where we start getting into browser limitations - you can't use the report-uri directive in a meta tag.
Let's personalize your content