Content Security Policy
Content Security Policy is a response header that restricts which scripts, styles, and other resources a page may load, limiting injection damage.
A strict policy is the most effective mitigation for cross-site scripting, but it needs testing in report-only mode before enforcement. Continue with HTTP headers you should recognise for the longer explanation.