Could this work on sites with only HTML/CSS injection points?