title: How to implement content security policy?
body: <p>There's good articles explaining the options for CSP like this one:
  <a href="http://www.html5rocks.com/en/tutorials/security/content-security-policy/" rel="noreferrer">http://www.html5rocks.com/en/tutorials/security/content-security-policy/</a></p>
  
  <p>Perhaps it's completely obvious because I can't find any good examples but how do you actually implement CSP in practise?</p>
  
  <p>In PHP you can set the header on a page you serve, but what if you just have a HTML file? Do you have to do it through your webserver, apache or similar? That doesn't seem an easy approach.</p>
  
  <p>What's the best practise here? Every individual page served should have the header manually set?</p>
  
  <p>Thanks!</p>