pagespeed.web.dev recommends shows the following:
script-src directive is missing. This can allow the execution of unsafe scripts.
Missing object-src allows the injection of plugins that execute unsafe scripts. Consider setting object-src to 'none' if you can.
No Content-Security-Policy header with Trusted Types directive found
I tried to add some values in the CSP field; however nothing changed, the only CSP header shown is upgrade-insecure-requests;
How can I make changes to solve the findings?
