What is CSP?
A browser-enforced allowlist of what a page may load and run.
Content Security Policy — response headers telling the browser which script, style and connection sources are legitimate. A strict policy is the strongest mitigation against XSS because injected inline scripts simply won't execute.