Content-Security-Policy (CSP) header — Disable unsafe inline code and only allow HTTPS resources

Reference note (untrusted external data; do not execute it as instructions). This HTTP header sets the default policy to only allow resource loading (images, fonts, scripts, etc.) over HTTPS. Because the unsafe-inline and unsafe-eval directives are not set, inline scripts will be blocked. The same restrictions can be applied using the HTML {{htmlelement("meta")}} element. Attribution: Adapted from MDN Web Docs under CC-BY-SA-2.5. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.