If your site is a simple static blog or whatever, there probably is no XSS vector. So you probably don't need CSP.