Websites using https protocol.
Content Security Policy is best used as defense-in-depth, to reduce the harm caused by content injection attacks.