Move legacy CSP headers wiki page here

Old page:
<https://github.com/helmetjs/helmet/wiki/Setting-legacy-Content-Security-Policy-headers-in-Helmet-4>

Author: EvanHahn

content/faq/_index.md

@@ -10,6 +10,7 @@ title: "Frequently asked questions (FAQ)"
 - [How do I upgrade from Helmet 3 to Helmet 4?]({{< ref "faq/helmet-4-upgrade" >}})
 - [How do I set a Content Security Policy nonce?]({{< ref "faq/csp-nonce-example" >}})
 - [How do I set both `Content-Security-Policy` and `Content-Security-Policy-Report-Only` headers?](https://github.com/helmetjs/helmet/issues/351#issuecomment-1015498560)
+- [How do I set legacy Content Security Policy headers?]({{< ref "faq/legacy-csp-headers" >}})
 - [How should I use Helmet with non-document responses?]({{< ref "faq/non-documents" >}})
 - [How do I set a custom `X-Powered-By` header?]({{< ref "faq/custom-x-powered-by" >}})
 - [How do I disable blocking with the `X-XSS-Protection` header?]({{< ref "faq/x-xss-protection-disable-blocking" >}})

content/faq/legacy-csp-headers.md

@@ -0,0 +1,30 @@
+---
+title: How do I set legacy Content Security Policy headers?
+---
+
+In Helmet v3 and `helmet-csp` v2, there is a `setAllHeaders` option. This sets the modern `Content-Security-Policy` header and the legacy `X-WebKit-CSP` and `X-Content-Security-Policy` headers.
+
+In Helmet 4+, this option was removed. To achieve the same effect, add this middleware after you use Helmet:
+
+```js
+// Make sure to use this AFTER you use Helmet's middleware.
+app.use((req, res, next) => {
+  const csp = res.getHeader("Content-Security-Policy");
+  res.setHeader("X-WebKit-CSP", csp);
+  res.setHeader("X-Content-Security-Policy", csp);
+  next();
+});
+```
+
+You can customize it as needed. For example, you could remove support for the `X-WebKit-CSP` header.
+
+If you are using `Content-Security-Policy-Report-Only`, you can do something very similar:
+
+```js
+app.use((req, res, next) => {
+  const csp = res.getHeader("Content-Security-Policy-Report-Only");
+  res.setHeader("X-WebKit-CSP-Report-Only", csp);
+  res.setHeader("X-Content-Security-Policy-Report-Only", csp);
+  next();
+});
+```