@gruber This is how @t turned off ad injection on his site. https://indiewebcamp.com/Content-Security-Policy