Should one consider CSP at the very early stage of starting a new website or under what conditions should one consider implementing CSP.

CSP on MDN
Content-Security-Policy-Report-Only

When to add a CSP (Content Security Policy)