This doesn’t create an XSS vulnerability as a outcome of CSS can not execute JavaScript (with rare exceptions which are coated by other directives). This blocks inline scripts and scripts from unknown domains. A well-configured CSP prevents XSS from executing even when an attacker successfully injects script content. You can find your .htaccess file under… Continuar lendo HTTP Headers