Website · Fix guide
Content Security Policy missing
- CSP
- Content Security Policy
No CSP header was found to limit where executable and embedded content may load from.
What is a Content Security Policy?
CSP is a browser security policy that limits which sources may provide scripts, styles, frames and other content. A carefully designed policy reduces the impact of cross-site scripting and content injection.
What to do next
- Start with Content-Security-Policy-Report-Only.
- Record the sources the application genuinely needs.
- Remove unsafe allowances where possible, then enforce the policy.
Useful links
How to verify the fix
Exercise important pages and confirm the browser console has no unexpected CSP violations.
When this result may be wrong
A policy can be delivered by a meta element, which a header-only check may not see; report-only CSP is also intentionally non-enforcing.
Ready to check again?
Check a domain
Run a fresh report after DNS caches and platform changes have had time to update.