Security Headers and CSP in 2026: Practical Reset for Static Sites

W3C CSP Level 3 remains a Working Draft as of the 13 August 2026 snapshot. MDN updated its CSP and practical-implementation guides in March and August 2026, while the Reporting-Endpoints header (baseline since September 2024) now replaces the older Report-To syntax.

For static-site teams the practical path in 2026 is to start in report-only mode, adopt Reporting-Endpoints for violation collection, and pair the policy with HSTS and COOP/COEP isolation headers. OWASP Secure Headers content moved to its GitHub project page after the 2026 CMS decision.

Trusted Types support is now documented in the MDN CSP guide and gives client-side XSS defense without changing application code for many frameworks. Strict CSP plus report-only rollout remains the safest on-ramp according to the August 2026 MDN guidance.

Small teams running Astro or similar static generators on CDN hosts can implement these headers at the edge or origin without application changes. A practical starting policy uses default-src ‘self’, script-src ‘self’, and object-src ‘none’, then relaxes directives only after the reporting endpoint shows which resources a strict policy breaks.

Collect reports first, tune the policy, then enforce.

Sources: W3C CSP3 WD (13 Aug 2026), MDN CSP (22 Mar 2026), Reporting-Endpoints (20 Apr 2026), MDN Practical CSP (15 Aug 2026), OWASP Secure Headers (2026 migration).