diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
new file mode 100644
index 000000000..9ff4ea856
--- /dev/null
+++ b/.github/workflows/spellcheck.yml
@@ -0,0 +1,15 @@
+name: Spellcheck Action
+on: push
+
+jobs:
+  build:
+    name: Spellcheck
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+    # The checkout step
+    - uses: actions/checkout@v4
+    - uses: rojopolis/spellcheck-github-actions@v0
+      name: Spellcheck
diff --git a/spellcheck.yaml b/spellcheck.yaml
new file mode 100644
index 000000000..06a08b28e
--- /dev/null
+++ b/spellcheck.yaml
@@ -0,0 +1,21 @@
+matrix:
+- name: Markdown
+  aspell:
+    lang: en
+  dictionary:
+    wordlists:
+    - wordlist.txt
+    encoding: utf-8
+  pipeline:
+  - pyspelling.filters.markdown:
+      markdown_extensions:
+      - pymdownx.superfences
+  - pyspelling.filters.url:
+  - pyspelling.filters.html:
+      comments: false
+      ignores:
+      - code
+      - pre
+  sources:
+  - 'content/**/*.md'
+  default_encoding: utf-8
diff --git a/wordlist.txt b/wordlist.txt
new file mode 100644
index 000000000..d9ea47d05
--- /dev/null
+++ b/wordlist.txt
@@ -0,0 +1,179 @@
+incrementations
+subresource
+subresources
+sandboxing
+backend
+mitigations
+CDNs
+bookFlatSection
+VRP
+CSRF
+Clickjacking
+XSSI
+MDN
+Bughunter
+XSLeaks
+Referer
+SameSite
+navigations
+dev
+untrusted
+CORB
+firefox
+Webkit
+WebKit's
+CORB
+JSON
+iframes
+impactful
+APIs
+CSP
+html
+UI
+jQuery
+JS
+bpp
+unsized
+ForceLoadAtTop
+HTTPS
+omnibox
+unencrypted
+omnibox
+bookCollapseSection
+Stateful
+ITP
+typeMustMatch
+POC
+PoC
+Onload
+XFO
+FIP
+SharedArrayBuffer
+Sandboxed
+jitter
+katex
+th
+TCP
+UDP
+OTP
+PINs
+Github
+repo
+shortcode
+HPACK
+hostnames
+DoS
+ReDoS
+runtime
+Matryoshka
+XSS
+Javascript
+onblur
+STTF
+viewport
+PII
+maxlength
+th
+linenos
+impactful
+linenostart
+eTLD
+iframing
+url
+maxlength
+iframe's
+Captcha
+autocomplete
+srcdoc
+inliner
+HTTPLeaks
+misconfigure
+deanonymize
+COSI
+webpage
+nosniff
+rollout
+AbortController
+quic
+ACAO
+CORS
+setTimeout
+Gmail
+api
+pdf
+nojs
+xsleaks
+postMessage
+untrusted
+AppSec
+Hemi
+Leibowitz
+OWASP
+HTMLElement
+HTMLMediaElement
+HTMLImageElement
+HTMLVideoElement
+HTMLFormElement
+js
+javascript
+captcha
+getComputedStyle
+getVideoPlaybackQuality
+misconfigurations
+rfc
+noTitle
+preload
+COEP
+Atomics
+requestAnimationFrame
+misconfiguration
+setTimeout
+microarchitectural
+Brasco
+Clapis
+Dworken
+Fredrickson
+Medi
+NDevTK
+Zayne
+Zeyu
+Zhang
+ath
+bs
+jub
+lastBr
+terjanq
+titor
+Braun
+Frederik
+Kinugawa
+Luan
+Masas
+Masato
+larson
+reever
+sirdarckcat
+sroettger
+bookToc
+CSRF
+XSLeaks
+composability
+csrf
+typeMustMatch
+Gelernter
+Herzberg
+xs
+secmetadata
+WebKit
+explainer
+clickjacking
+typemustmatch
+iframe
+SharedArrayBuffers
+IntersectionObserver
+naïve
+unviable
+iframe
+onload
+referer
+framable