A Content-Security-Policy header is one of the highest-leverage security headers you can set, and one of the easiest to get wrong by hand. Miss a source your site actually loads from and you break it; too permissive and it does nothing. Check what you use below and copy the result straight into your config. Everything here runs in your browser. Nothing you select is sent anywhere.
What does your site use?
Framework needs
Your CSP header
default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';
Paste this as the value of a Content-Security-Policy header. In Next.js, via headers() in next.config.js; on other stacks, in your server or CDN config. Test it before relying on it. An overly strict policy can silently break an integration you forgot to check above.