default-src 'self';
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.example.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
img-src 'self' data: https://picsum.photos;
font-src 'self' https://fonts.gstatic.com;
connect-src 'self' https://api.example.com;
form-action 'self';
frame-ancestors 'none';
base-uri 'self';
object-src 'none';
report-uri https://example.com/csp-report;
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Accept-Ranges: bytes
反腐倡廉
