CSP

Content-Security-Policy — HTTP header that restricts which scripts/styles a page can load.

CSP is the most effective single header against XSS. Set script-src 'self' and stray inline scripts fail to execute; XSS payloads become inert.

Try the Http Headers tool →