csp

Cached pages are supposed to need a hash-based CSP. Here’s why I used a nonce on a Cloudflare-cached WordPress site, and what that costs.