security · security.content-security-policy.missing
Missing Content-Security-Policy header
CSP restricts which scripts may run. Without it, any reflected or stored XSS executes unmitigated.
Why it matters
CSP prevents XSS by restricting which scripts can run. Without it, any reflected/stored XSS hits unmitigated.
Example fix
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self' data: https:
Authoritative reference
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
Run a full audit of your site
Free, no signup, no crawl cap. Check this and 90+ other factors across every public page.
Audit my site →