A 'Content Security Policy' header response prevents a wide array of attacks such as code injection, and XSS attacks. Unfortunately, it's also one of the most difficult policies to implement and has the greatest potential to break the appearance of your site if implemented incorrectly. In short, there is no easy way to implement this policy into your htaccess file without extensive testing.
The 'Content Security Policy' controls what host URLs (domain names) are allowed to interact with your site. Therefore, every 3rd party URL that exists within your sites plug-ins or extensions needs to be added to your Content Security Policy and then have the appropriate rules applied against them.
The first step is to document all external URLs in your site's source code, then you
can use a CSP generator to create policies relating to each external URL. There is a great content security generator here: https://report-uri.com/home/generate
What makes it hard is that there are also external URLs being utilised by your site in it's JavaScript functions that you can't necessarily see in the source code. For example, analytics can introduce 5 different external URLs on your site which you can't easily see in the source code.
It's still possible to introduce a very rudimentary 'Content Security Policy' by using the below code which simply enforces that all external URLs use the https protocol. This is still better than having no policy at all and it will still let all in-line JavaScript and CSS work as well.
Header set Content-Security-Policy "default-src * data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'"