Add Subresource Integrity hashes to enqueued scripts and styles, approve changed files before they are trusted, and scan pages for missing SRI.