CSP (Content-Security-Policy)

Content-Security-Policy is a rule sent by the server that tells the browser which sources it may load scripts, styles or images from. A well-configured CSP means a script injected by an attacker simply will not run.

It is one of the most effective layers of defence against XSS attacks. It requires careful configuration, but once set it protects every visitor to the site.