Skip to content
whois.me.uk
Menu
Sign in

CSP-MISSING

No Content-Security-Policy

What it means

CSP limits where scripts, styles and frames may load from. It is the single most effective mitigation for cross-site scripting.

How to fix it

  1. 1Start with Content-Security-Policy-Report-Only and a report endpoint to see what the site actually loads.
  2. 2Tighten to an enforced policy, ideally with nonces for inline scripts.

Re-check after the change

DNS changes can take up to the record's TTL to be seen; use Re-run on the result page to bypass our 10-minute cache.