I am trying to disable JS on my website using HTTP headers, currently using CSP and have made checks fail on purpose:
Content-Security-Policy = "upgrade-insecure-requests; sandbox; script-src 'sha512-v'; object-src 'none';"
Mainly the sha512 stuff, but also other stuff helps too like sandbox
Any way to actually cleanly disable JS using http headers or am I stuck with this?
I tried none as script-src value, but it just threw me a warning that it's ignoring it, any other way?