Gating Third-Party Scripts
Dropping Google Analytics directly into your `head` tag violates the ePrivacy Directive immediately.
Content Security Policy (CSP)
A CSP header is an HTTP response header that restricts where scripts can be loaded from and where they can send data. If an attacker injects a malicious script (XSS), a strong CSP will block it from executing.
| Directive | Usage |
|---|---|
| `default-src 'self'` | Denies all third-party resources by default. |
| `script-src 'strict-dynamic'` | Allows scripts based on cryptographic nonces. |