[fabian2k]

I would suspect that ads make it difficult if not impossible to write a good CSP. It's also probably much easier to create a good CSP if you start with it, and much harder and likely to break unexpectedly if you try to add it retroactively on an existing site.

I also found that some modern tooling for web apps doesn't seem to be built with CSPs in mind. For example CSS styling in JS like React Styled Components, I'm not sure it's even possible to create a CSP that covers CSS in this case.

[pintxo]

It is, but often not supported out of the box. You will need to extract any css during the build into separately served files. Also it‘s a pain during development. But it‘s possible.