Zero of our 79 pages send a Content-Security-Policy, and the strict version would need 892 hashes

The website in question sends six security headers on every response, but crucially, there is no Content-Security-Policy (CSP) among them. A content security policy would provide an additional layer of security by specifying which resources can be loaded on a webpage.

To verify this, the reporter searched through the 79 pages of the site's sitemap and found zero occurrences of a CSP. The repository also contained only one CSP, which was added by Next.js when optimizing images. This policy aims to prevent scripts from running in routes that should not be script hosts.

The reporter then estimated the cost of implementing a strict CSP on the site. For this, they counted the number of script tags with a src attribute, cross-origin script tags with integrity, inline script tags, inline JSON-LD blocks, and various other elements. They found that there are 1,496 script tags with src, 1,557 executable inline scripts, and 200 JSON-LD blocks.

The majority of these elements are not a significant security concern. The site does not have any forms, frames, plugins or base elements, which removes the need for several directives in the CSP. The reporter also noted that there are no javascript: URLs or style attributes in the site, further reducing the scope of the policy.

The most significant cost would come from the inline script tags and JSON-LD blocks. These would require hashes to be included in the CSP, adding to its size. However, the reporter found that JSON-LD blocks do not need hashes, as they are not executed as scripts.

In conclusion, while implementing a strict CSP could enhance security, the cost in terms of policy size and the need for per-route policies due to the site's dynamic nature could make it impractical.