> it's useful for when hosting statically.

You can configure your webserver to add those headers, when hosting statically. There is no need to include it in all your pages.

nginx: add_header Content-Security-Policy "...";