# CSP Fail

> Your CSP blocked something. Here is why, and how to fix it.

An independent Content Security Policy resource, sponsored by Report URI. No sign-up, no
paywall, no tracking. Content is CC BY 4.0 — reuse it freely with attribution.

Append `.md` to any URL below for clean Markdown of that page.

## Pages

- [CSP Fail](https://csp.fail/index.md)
- [about](https://csp.fail/about.md)
- [policy](https://csp.fail/policy.md)
- [why/default-src-fallback](https://csp.fail/why/default-src-fallback.md)
- [why/nonce-reused](https://csp.fail/why/nonce-reused.md)
- [why/unsafe-inline](https://csp.fail/why/unsafe-inline.md)

## The other two sites

- [CSP Academy](https://csp.academy/llms.txt) — learning CSP from scratch
- [CSP Fail](https://csp.fail/llms.txt) — diagnosing a CSP error
- [CSP Win](https://csp.win/llms.txt) — checking whether a policy is any good

## Machine-readable data

- [https://csp.fail/api/directives.json](https://csp.fail/api/directives.json) — every CSP directive: what it governs, whether it inherits from `default-src`,
  the recommended value, and the usual mistake