HSTS and CSP remain some of the highest-leverage defenses for session and injection classes of issues, but a single mis-step can brick assets or break third-party widgets.
Roll CSP in layers: start with Report-Only, collect violations grouped by URL and directive, fix inline scripts by moving to nonces or hashes where feasible, and only then enforce. HSTS should follow a measured max-age climb once HTTPS coverage is proven end-to-end, including subdomains you forgot existed.
Document third parties explicitly. Marketing stacks love tag managers; CSP loves deny-by-default. Negotiate allowlists with vendors and prefer single-purpose domains over broad wildcards.