#http

CSP without the tears: a security baseline for content sites

A copy-paste security headers baseline for content sites: Content-Security-Policy with nonces, report-only rollout, and the headers nobody checks until audit.