A csp can say that you only want to load things over https and Strict-transport security (HSTS) also helps here (see https://en.wikipedia.org/wiki/HTTP_Strict_T

A csp can say that you only want to load things over https and Strict-transport security (HSTS) also helps here (see https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ). I've found http://securityheaders.io http://securityheaders.io quite helpful in securing my servers alongside ssl labs server test (as others have mentioned) to check that your actual server and SSL certs are configured well.