Content Security Policy
Also called CSP
A header that tells the browser what this page may load and run: scripts only from here, no plug-ins, no framing. If an attacker's script gets into the page anyway, the browser can refuse to run it.
It's a second line of defence for when escaping fails somewhere. It's also easy to weaken: one 'unsafe-inline' added to quiet an error removes much of the protection, and an agent fixing a broken page may well do that.
Say it to your agent
“Add a CSP with default-src 'self'; script-src 'self' 'nonce-…'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'. Ship it as Content-Security-Policy-Report-Only first, then enforce. Don't add 'unsafe-inline' to fix an error. Tell me which script broke.”