The CSP option already exists in Elxis configuration since v5.5. However Elxis HTML was not ready for a strict CSP policy. In version 5.6 everything inline removed, even the js events.

Conversion example
Original HTML
<a href="javascript:void(null);" onclick="doSomething();">Do something</a>

New HTML:
<a href="#" id="dolink">Do something</a>

In PHP:
$eDoc->addNativeDocReady('doOnLoad();');

In javascript file:
function doOnLoad() {
    document.getElementById('dolink').addEventListener('click', function(e) { e.preventDefault(); doSomething(); });
}

If you have many links executing the same js function it is recommended to use "data-" attributes. Example:

<a href="#" data-something="12">Do 12</a>
<a href="#" data-something="15">Do 15</a>
<a href="#" data-something="18">Do 18</a>

let dnlinks = document.querySelectorAll('a[data-something]');
if (dnlinks.length > 0) {
   for (let q=0; q<dnlinks.length; q++) {
           dnlinks[q].addEventListener('click', function(e) {
         let nid = this.getAttribute('data-something'); e.preventDefault(); doSomething(nid);
      });
   }
}

All inline events, CSS and javascript removed. Even JQuery library modified in order to be compatible with strict CSP policies.

Recommended CSP policy for Elxis configuration (Elxis 5.6 or newer, make sure third party extensions are compatible):

default-src 'self'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'nonce-{nonce}'; style-src 'self' 'nonce-{nonce}'; img-src 'self' *.elxis.net data:;

Note: {nonce} get replaced automatically by elxisDocument with the corresponding value.

Hi there,
I was able to use DeepL API translation but it doesn't seem to be working anymore, I have tested on several Elxis installations on different hosts.
I get a 403 authentication error.
I have tried with valid FREE and PRO API keys, but the same error. Google translate and MyMemory are working.
I'm wondering if anyone else has had the same problem, maybe something has changed on the DeepL side?

That's great about the module ID!