Content Security Policy (CSP)

CSP is a response header that restricts which scripts, styles, images, and fonts a browser will load on your page. A minimal CSP blocks inline scripts and external sources you don't explicitly allow — mitigating XSS. For indie launches, start with a reporting-only CSP for two weeks, watch the violation reports, then tighten to enforcement. Launching without any CSP is not catastrophic but leaves XSS wider than needed.