CSP is the most effective single header against XSS. Set script-src 'self' and stray inline scripts fail to execute; XSS payloads become inert.
CSP
Content-Security-Policy — HTTP header that restricts which scripts/styles a page can load.
Content-Security-Policy — HTTP header that restricts which scripts/styles a page can load.
CSP is the most effective single header against XSS. Set script-src 'self' and stray inline scripts fail to execute; XSS payloads become inert.