content-security-policy

object-src 'none'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content