The HTTP response header Content-Security-Policy allows site administrators to control which resources user agents can load for a given page. With a few exceptions, the policies set mainly involve specifying the server's origin and script endpoints. This will help prevent cross-site scripting attacks.

Force https

Add code

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Browser compatibility

• https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Content-Security-Policy#浏览器兼容性

Free https certificate

• Recommend a free https certificate website:https://freessl.cn/