I&#x27;ve gotten into the habit of starting off every new project of mine with the header &quot;Content-Security-Policy: script-src &#x27;self&#x27;&quot; on all pages, and whitelisting domains and &#x27;unsafe-eval&#x27; as I need them. (&#x27;unsafe-eval&#x27; isn&#x27;t so bad. &#x27;unsafe-inline&#x27; is the really unsafe one that you want to avoid because it undoes the XSS protection. Eval has legitimate uses and eval-based vulnerabilities are not anywhere near as easy to accidentally create and never notice as a regular XSS vulnerability. I&#x27;d bet that everyone who has really written Javascript+HTML without CSP has created a regular XSS vulnerability at some point.)<p>There&#x27;s no excuse to not start new projects off with a CSP rule like that. Doing it from the start means you won&#x27;t ever have to comb through your codebase later to remove all bits of inline javascript that you depend on to get the benefits.