OWASP XSS Prevention Cheat Sheets

Official docs outline

Cross Site Scripting Prevention
Context-aware output encoding for HTML, attribute, JavaScript, CSS and URL contexts.
DOM based XSS Prevention
Safe DOM sinks, textContent and untrusted data in client-side code.
DOM Clobbering Prevention
Preventing DOM clobbering via named elements.
XSS Filter Evasion
Payload obfuscation techniques that bypass naive filters.
Content Security Policy
CSP nonces, hashes, strict-dynamic and report-only rollout.
HTML5 Security
postMessage, WebSockets, CORS, sandboxed iframes and web storage.
Clickjacking Defense
frame-ancestors, X-Frame-Options and SameSite cookies.
XS Leaks
Cross-site leak side channels and mitigations.
HTTP Headers
Security response headers such as CSP, HSTS, nosniff and Referrer-Policy.
Third Party JavaScript Management
Subresource Integrity and third-party script risk.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.