SEC-008Security headers, and which pages must be exemptA tight Content-Security-Policy breaks ad embeds and pasted network code. Set it globally, exempt the pages that carry third-party markup.PHPTested on PHP 8.2, MariaDB 10.6