# Content-Security-Policy

The snippet loads one JS file and POSTs JSON to /api/collect on the script origin.

script-src 'self' https://www.zarstat.co.za;
connect-src 'self' https://www.zarstat.co.za;

If you first-party proxy both paths, 'self' is enough. No Maps, Ads, or PageSpeed hosts.

HTML twin: https://www.zarstat.co.za/docs/csp