I have recently deployed Content Security Policy (CSP) on a website. When I first looked at violation reports, my jaw dropped. The amount of malware (rouge extensions, toolbars, viruses, ...) that is blocked is staggering.<p>If you really want to help your (clueless) users, never <i>ever</i> serve a login, registration or credit card form without CSP. It really helps - at least until the malware catches on (I already see &quot;Kaspersky Labs&quot; is injecting its domain <i>into the CSP itself</i>).