School · Module 4 · Lesson 3 of 4
Lock down headers and CSP
A strict Content-Security-Policy stops a whole class of XSS and supply-chain script injection.
Ship at least Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, and a frame-ancestors or X-Frame-Options deny.
Prefer external scripts with hashes or nonces over unsafe-inline for script-src. ShipSafe itself uses script hashes for the few inline boot scripts.
Add Strict-Transport-Security once you are sure HTTPS works end to end.