The HTTP response header Content-Security-Policy allows site administrators to control which resources user agents can load for specified pages. With a few exceptions, the policy primarily concerns specifying the server's origin and script endpoint. This helps prevent cross-site scripting attacks.

Force the use of HTTPS

Add code

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Browser compatibility

• https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Content-Security-Policy#浏览器兼容性

Deployment Recommendations

HTTPS deployment is required.

Pagoda Deployment

• The BT Panel for server maintenance allows you to apply for Let's Encrypt certificates with one click and automatically renew them.

Other deployments

• Installing other web servers requires you to apply for a Let's Encrypt HTTPS certificate yourself, which needs to be applied for every 3 months, making the process complicated.