diff --git a/README.md b/README.md
index 6d79149c..76e97266 100644
--- a/README.md
+++ b/README.md
@@ -137,6 +137,7 @@ built in Norway 🇳🇴 with contributions from [not-norway](https://github.com
     * [client-side](#client-side) - when uploading files
 * [security](#security) - there is a [discord server](https://discord.gg/25J8CdTT6G) with announcements
     * [gotchas](#gotchas) - behavior that might be unexpected
+    * [csp nonce](#csp-nonce) - unauthorized javascript is blocked
     * [cors](#cors) - cross-site request config
     * [filekeys](#filekeys) - prevent filename bruteforcing
         * [dirkeys](#dirkeys) - share specific folders in a volume
@@ -3107,6 +3108,23 @@ behavior that might be unexpected
   * or eliminate the problem entirely by only giving write-access to trustworthy people :^)
 
 
+## csp nonce
+
+unauthorized javascript is blocked  by means of the default [content-security-policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) which enforces "script nonces", to help prevent XSS and similar
+
+usually this Just Works and is correctly configured by default; you can stop reading this section and move on, nothing to see here
+
+but if you are the unlucky 0.1% with a hosting-setup funky enough for this to not work as intended, then you will also be seeing this message: `Looks like javascript is broken; see "csp nonce" in the readme`
+
+there is two possible reasons why this might happen:
+
+1. your browser is simply too old to understand the javascript, which is not likely, because just about every browser is supported, even internet explorer 11
+
+2. something in your hosting-setup is tampering with the responses from copyparty and destroying this security feature; the culprit is probably a misconfigured reverseproxy, a CDN, a WAF, or some other mitm, but a popular offender is **"cloudflare rocket loader"**
+
+you can try to **temporarily** set global-options `--csp-ui no` and `--csp-dl no` and restart copyparty to check whether it is due to reason #2. Remember to refresh the webbrowser with CTRL-SHIFT-R to check properly. If that makes the problem go away, then turn them back off (**never** keep them enabled), restart copyparty, open the `Network` tab in the webbrowser, and refresh the website; you should see the `content-security-policy` header including a nonce, for example `nonce-BxcJbvdu1z3S/ycPBjVWuA==` which should also appear inside the HTML of that response like this: `<script nonce="BxcJbvdu1z3S/ycPBjVWuA==">` -- if it doesn't then that's the problem; something in your hosting stack is dangerously misconfigured
+
+
 ## cors
 
 cross-site request config
diff --git a/copyparty/authsrv.py b/copyparty/authsrv.py
index b7be0524..abe77ccc 100644
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -2660,10 +2660,11 @@ class AuthSrv(object):
             if head_s and not head_s.endswith("\n"):
                 head_s += "\n"
 
+            zs2 = "Content-Security-Policy: %s\r\n"
             zs = vol.flags.get("csp_ui", "")
-            csp_ui = "Content-Security-Policy: %s\r\n" % (zs,) if zs else ""
+            csp_ui = zs2 % (zs,) if zs.lower() not in ("", "no") else ""
             zs = vol.flags.get("csp_dl", "")
-            csp_dl = "Content-Security-Policy: %s\r\n" % (zs,) if zs else ""
+            csp_dl = zs2 % (zs,) if zs.lower() not in ("", "no") else ""
 
             zs = "X-Content-Type-Options: nosniff\r\n"
             if "norobots" in vol.flags:
diff --git a/copyparty/web/browser.html b/copyparty/web/browser.html
index 61a37526..964d910b 100644
--- a/copyparty/web/browser.html
+++ b/copyparty/web/browser.html
@@ -121,6 +121,8 @@
 
 	<h2 id="wfp"><a href="{{ r }}/?h" id="goh">control-panel</a></h2>
 
+	<p id="js_bork">Looks like javascript is broken; see "csp nonce" section in readme</p>
+
 	<a href="#" id="repl">π</a>
 
 </div>
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index 7e13bdc1..017c72f8 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -7790,6 +7790,7 @@ var treectl = (function () {
 
 	r.hydrate = function () {
 		qsr('#bbsw');
+		qsr('#js_bork');
 		srvinf = ebi('srv_info').innerHTML.slice(6, -7);
 		if (ls0 === null) {
 			r.ls_cb = showfile.addlinks;