P1 · HighSecurity
Missing CSP header
No Content-Security-Policy header
Code: missing_csp
Why it matters
No Content-Security-Policy header. Browsers and users expect sites to be secure. Missing protections expose visitors to data theft, phishing, and loss of trust.
How to fix
Add Content-Security-Policy header
http# Nginx — add inside your server {} block
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'" always;
# Apache — add to .htaccess or <VirtualHost>
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'"Related checks in Security
Run a free scan to check your site
Get a complete audit in under 2 minutes. No account required.
Start Free Scan