Content Security Policy (CSP) is an HTTP header that tells browsers which sources are allowed to load resources.
💡 Start with
Content-Security-Policy-Report-Only — collect violations for a week, then enforce the strict policy.