Security headers check
A Content Security Policy is set
A Content-Security-Policy header exists, and script-src does not rely on unsafe-inline.
low severitysec.csp
Run this check on your site
Runs just this check in quick mode. The report opens with the evidence and the fix.
Why it matters
A content security policy is the strongest defence against cross site scripting. It limits what an injected script is allowed to do.
How to fix it
Start with a report only policy, then tighten it. Hashes or nonces remove the need for unsafe-inline.
The details
- Category
- Security headers
- Severity of a failure
- low
- Confidence
- high
- Needs a browser
- No
- Check id
- sec.csp