Web Application Security 101

Do what I say is one of the basic rules of security. And, in a web application, the "what i say" is a set of security headers (Content-Security-Policy, XSS, Cross Origin Request).
If your site uses CDN, Ad's, user-generated content, you owe this to your users, your brand.
I have a thesis: any company that doesn't bother with Content-Security-Policy on their main web site has a poor culture of security elsewhere. They may argue that the main web site is not intended to be secure, its read-only content. Until the day it has some grafitti on it. Do you want a company who doesn't care about the front door security handling your data elsewhere?

My call to action: Learn these Web Application Security 101 techniques. Apply them to a site you own or influence. Teach someone else about them. Let's pay it forward.