Popunder block: in proxy mode via vc-proxy.php's blocker (ad script stripped, ad flag flipped, ad POST / window.open blocked) — NO iframe csp attribute in proxy mode, because Chrome blocked the same-origin vc-proxy frame with ERR_BLOCKED_BY_CSP when the csp attribute was present (v6.5, HAR vidcore-4). In direct mode, popunder block is via the iframe csp attribute below (when enabled in config): script-src allows only vidcore + gstatic, so vidcore's injected gogtib / chiveyfewmets ad script is blocked by the browser, with no sandbox detection triggered. -->