Missing Content-Security-Policy Header

What this finding means

Your site does not send a Content-Security-Policy header. There is no browser-enforced allow-list restricting where scripts, styles, or other resources can load from, so if any part of the site is ever tricked into rendering attacker-supplied markup, the browser has no additional layer stopping it from executing.

Why it matters

CSP is one of the strongest browser-side defenses against cross-site scripting (XSS) and content-injection attacks. If an attacker manages to inject a `<script>` tag or an inline event handler into a page (through a comment field, a stored-XSS bug, a compromised third-party script), a well-configured CSP stops the browser from executing it because the injected content doesn't come from — or match the rules of — an allowed source. It also restricts framing and mixed content when the right directives are set.

What Nivaronix checks

Nivaronix's security headers checker inspects the response headers your site sends and reports whether Content-Security-Policy is present. This is a security misconfiguration check based on the header's presence and configuration — not a vulnerability scan, exploit attempt, or penetration test.

Evidence example

Example only, for illustration — not evidence from a live scan of any specific site.

HTTP/1.1 200 OK
(no Content-Security-Policy header present)

How to fix it

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;

Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self';"

Rules → Transform Rules → Modify Response Header → set `Content-Security-Policy` to your policy string (or set it in a Worker if the value needs to vary per route).

Verify the fix

Re-run a scan on your domain, or check manually with curl -sI https://your-domain.example, and confirm Content-Security-Policy now appears in the response with the expected value.

Standards reference

MDN — Content-Security-Policy. See the methodology page for exactly how this finding is scored.