Missing Content-Security-Policy header

Why it matters

No Content-Security-Policy header is set, so the browser has no allowlist restricting which scripts and resources may load, weakening XSS protection.

What to do

Add the missing security header at the server/CDN level.

IT/Security · About 2 hours · Needs a specialist

How to fix it

1. Add the missing header at the web server, CDN, or platform configuration level (exact method depends on hosting).
2. Start with a permissive policy (e.g. CSP report-only mode) and tighten iteratively to avoid breaking functionality.
3. Re-test with a header-scanning tool after each change.