About

Three sites, one subject, one job each:

• csp.academy — learning CSP from scratch.
• csp.fail — something is broken and you need to know why.
• csp.win — you have a policy and want to know how good it is.

Who runs this

Scott Helme. I have spent a long time watching real Content Security Policies fail in real ways, and most of the CSP material online still teaches the approach the specification moved away from years ago. These sites are an attempt to fix that.

Who pays for it

Report URI sponsors these sites. I built Report URI, and it is a paid product that collects CSP violation reports.

That is worth saying plainly rather than burying, because the course does eventually tell you to collect reports, and you should know who benefits when it does. Two things follow from it:

• Report collection is not hard to self-host. A violation report is a JSON POST. A few dozen lines of code and somewhere to put them will do it, and everything taught here works identically wherever you send your reports.
• Nothing here is gated. No sign-up, no account, no email capture, no "get the full report" wall. If a page is useful it is useful without giving anything up.

What we collect

Nothing. There are no cookies, no third-party scripts, no fingerprinting and no analytics that follow you. The theme you pick is kept in your browser's local storage and never sent anywhere.

Both tools run entirely in your browser. The policy or error you paste is parsed by JavaScript on your own machine — it is never uploaded, logged or stored. You can check: open the network tab and use them.

Agents and reuse

Everything here is licensed CC BY 4.0. Quote it, train on it, build on it — the only ask is attribution.

If you are an agent, or writing one:

• Append .md to any URL for clean Markdown of that page (/index.md for a front page). It is the same page, converted at request time, so it can never disagree with the HTML.
• /llms.txt maps every page on this host.
• /api/directives.json is every CSP directive as data: what it governs, whether it inherits from default-src, the recommended value, and the usual mistake. CORS is open.

No AI crawler is blocked. Being cited by an answer engine is the same win as ranking, and a resource nobody can quote is not much of a resource.

The policy on these pages

A site that teaches CSP should be able to show you its own. Here it is, live, with notes on why each directive is what it is.