Content-Security-Policy missing
Check id: hdr.csp_missing · fix effort: high
What it means
Your site doesn't restrict where scripts can load from, which is the main browser-side defense against injected code. Real effort to do well, so treat it as a project, not a quick fix.
The technical detail
No Content-Security-Policy header. Start report-only to inventory violations, then enforce.
How to fix it
- Start with a report-only policy to inventory violations.
- Deploy a policy allowing only your origins; tighten iteratively.
Does your domain have this problem?
Run a free scan, takes about ten seconds.