Content-Security-Policy header

lowsecurity-csp

What a CSP header does, why a missing one leaves a page open to XSS, and how to add one — with the same config the scanner's own fix suggests.

What it is

Content-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page is allowed to load. Anything not on the allow-list is blocked before it runs, regardless of how it got onto the page.

A page with no CSP header has no such allow-list: the browser executes inline or injected script exactly as readily as script the site's own developers wrote.

Why it matters

CSP is the standard defense against cross-site scripting (XSS). Even if an attacker injects a <script> tag through a comment field or an unescaped query parameter, a policy that restricts script-src to the site's own origin stops that script from executing.

It's one header, applied once at the server or CDN, protecting every page on the origin — no per-page work required. Most sites roll it out in report-only mode first, so they can see what a strict policy would break before enforcing it.

How to fix it

with a reference doc

nginx

add_header Content-Security-Policy-Report-Only "default-src 'self'" always;

.htaccess

Header always set Content-Security-Policy-Report-Only "default-src 'self'"

next.config.js

async headers() {
  return [{
    source: '/(.*)',
    headers: [{ key: 'Content-Security-Policy-Report-Only', value: "default-src 'self'" }]
  }];
}

_headers

/*
  Content-Security-Policy-Report-Only: default-src 'self'

Reference documentation

Related checks

mediumStrict-Transport-Security (HSTS) headerStrict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.mediumClickjacking protectionClickjacking protection stops another site from loading yours inside an invisible <iframe> and tricking a visitor into clicking something they didn't mean to. It's enforced with either the X-Frame-Options header or a Content-Security-Policy frame-ancestors directive.lowX-Content-Type-Options headerX-Content-Type-Options: nosniff tells the browser to trust the Content-Type header a server sends and stop guessing a resource's type from its content.highMixed contentMixed content is any http:// resource — a script, stylesheet, image or iframe — loaded on a page served over https://. The page itself is encrypted; the mixed-content resource is not.

This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.

What it is

Why it matters

How to fix it

Related checks

See whether your own site passes content-security-policy header.