foundeo/content-security-policy.com/master/www/.htaccess

Header set Content-Security-Policy "default-src 'none'; script-src 'self' www.google-analytics.com 'sha256-xzi4zkCjuC8lZcD2UmnqDG0vurmq12W/XKM5Vd0+MlQ='; style-src 'self' https://maxcdn.bootstrapcdn.com https://fonts.googleapis.com; font-src https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com; img-src www.google-analytics.com;"

On Github License