I see people mention noscript and uMatix a lot, but you should also consider RequestPolicy for added protection: https://requestpolicycontinued.github.io/