Web security
Content-Security-Policy restricts scripts
Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.
Why it matters
CSP is the safety net against cross-site scripting (XSS), the most common web vulnerability. Without it, one injection bug lets attackers steal sessions, skim card details or deface pages.
How to fix it
Moderate · a few hours- Start in report-only mode to see what the site loads without breaking anything.
- List the script, style, image and font sources the site needs.
- Switch the header from Content-Security-Policy-Report-Only to Content-Security-Policy.
- Reload the web server and re-run the scan to confirm.
nginx (starting point)
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
Apache (report-only first)
Header always set Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; frame-ancestors 'none'"
Test this now, free: Security headers checker - no sign-up.
How we test it
The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.
Does your domain pass this check?
Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.
Scan your domain free