Our site has mainly non tech people on it, a large amount of those have browsers that inject js/css into our HTML, I would say that is something user hostile.

Our site has mainly non tech people on it, a large amount of those have browsers that inject js/css into our HTML, I would say that is something user hostile. When we tested CSP with report-only I had to stop counting at 20 different malwares, the analysis was that even though CSP helps, those malware authors would just find another way. Thousands of our users were affected. Do you think HTTPS is user hostile as well, not being able to read all the network traffic generated on my machines feels off for me. In the end I guess HTTPS is good for the user and so is CSP.