Every web response carries a few headers that cost nothing and close common holes:

header	default	what it does
`X-Content-Type-Options`	`nosniff`	the browser takes the content type as sent, and does not guess one
`Referrer-Policy`	`strict-origin-when-cross-origin`	other sites see where a visitor came from, not the full address
`Content-Security-Policy`	`frame-ancestors 'self'`	no other site can show your pages in a frame

$padSecurityHeaders in _config/config.php lists the first two, name => value - an empty value leaves one out, [] sends none - and $padCsp is the policy, '' for none. A header the page's own PHP sent stands over the default.

A strict policy and the {nonce} tag

A strict policy refuses inline scripts - which is the point: a script someone smuggled into the page does not run. Your own inline script runs when it carries the request's nonce. Write 'nonce', with the quotes, in the policy, and {nonce} in the script tag; the engine puts the same random value in both, new for every request:

$padCsp = "default-src 'self'; script-src 'self' 'nonce'; frame-ancestors 'self'";

PHP	HTML fragments/security_headers_1.pad	Result
	`<script nonce="{nonce}">{ignore} document.title = 'Hello'; {/ignore}</script>`

The nonce is written only where the template writes {nonce}. The engine does not add it to the page's script tags: a smuggled script would get it as well.
{nonce} goes outside an {ignore} block - inside one it is text. The script's body, with its braces, is what the {ignore} is for.
A page carrying a nonce is never stored in the page cache.