Content-Security-Policy: default-src 'self' https://cdn.example.com; object-src 'none'; frame-ancestors 'self'; form-action 'self'; report-uri /example-reporting-endpoint