Content-Security-Policy: default-src 'self';
  script-src 'self' https://trusted-cdn.com https://another-trusted.com;
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https://trusted-images.com;
  font-src 'self' https://fonts.gstatic.com;
  object-src 'none';
  frame-ancestors 'self';
  form-action 'self';
  base-uri 'self';
  report-uri /csp-report-endpoint;