Checks

Missing Content-Security-Policy (CSP)

The response did not include an enforcing Content-Security-Policy.

Why it matters

Without CSP, an injected script is not restricted by a source list.

What to do

Start with a report-only policy, then enforce default-src and script-src. Report-only alone does not block anything.

Reference

CSP restricts script, style, and resource sources to mitigate injection attacks.

MDN — Content-Security-Policy