Skip to content
DomainGrade

What we checkSecurity headersHD-01

Your site has no Content-Security-Policy

Nothing limits which scripts the browser will run on your pages.

Area
Security headers
Check
HD-01
Included
Free in every scan

What we check

No Content-Security-Policy header was present on your homepage.

Why it matters

If a script does get onto your page — through a form, a third-party tag, a stale dependency — the browser runs it with full access to your page and your users' session.

CSP is the control that makes an injection an inconvenience rather than an incident.

Third-party scripts are the usual route in. An analytics tag, a chat widget, or a payment script runs with the same authority as your own code, and a compromise anywhere in that supply chain becomes a compromise of your page.

How to fix it

  1. 1

    Deploy Content-Security-Policy-Report-Only first and watch what it would have blocked.

  2. 2

    After a week, enforce it.

  3. 3

    Inventory the third-party scripts before you enforce; the report-only run will list them, including several nobody remembers adding.

A starting policy
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'self'

Common questions

I am worried about breaking the site.
Report-only mode exists exactly for that: it reports violations and blocks nothing.
My site loads scripts from several vendors.
List them. The report-only run tells you which, including the ones nobody remembered adding.
Is a partial policy worth having?
Yes. frame-ancestors 'none' alone closes clickjacking, and it is a one-line start.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other security headers checks