1. Apparatus for serving one or more content elements associated with a markup language document that has been processed to protect against a cross-site scripting attack, comprising: a processor; computer memory holding computer program instructions that when executed by the processor perform a method, comprising: for each of the one or more content elements, receiving a request, the request being associated with a reference in the markup language document, the reference having been substituted in the markup language page for the content element and being associated with a secure domain name that is uniquely associated with the content element; retrieving the content element if the apparatus is authoritative for a domain associated with the secure domain name; and serving the content element in response to the request.