Content Security Policy

What this check looks for

This check reads the homepage's Content-Security-Policy response header. If absent, it warns. If present with any value, it passes — this check confirms the header exists, not that its specific directives are optimally configured.

Why it matters

A Content-Security-Policy is a browser-enforced allowlist for where scripts, styles, images, and other resources can load from, which is one of the most effective defenses against cross-site scripting: even if an attacker manages to inject a malicious script tag into your page, a correctly configured CSP stops the browser from executing it because it doesn't come from an approved source. Without a CSP, a single input-sanitization bug anywhere on the site becomes a much more serious vulnerability than it would be with the policy in place as a backstop. This isn't itself an SEO or AI-visibility signal, but a compromised site is far more likely to end up flagged, delisted, or actively distrusted by both search engines and AI crawlers evaluating source safety.

How to fix it

Start with a conservative policy and tighten it as you confirm what the site actually needs:

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'

Roll out changes in Content-Security-Policy-Report-Only mode first if you're unsure what the policy might break, then switch to the enforcing header once the report shows no unexpected violations.