Some notes on setting up a CSP on a legacy site
Setting up a Content Security Policy (CSP) for a legacy site comes up with its own challenges, this article contains some tips that I have used.
https://blog.many-monkeys.com/posts/some-notes-on-setting-up-a-csp-on-a-legacy-site/