What is it?
Content-Security-Policy is an HTTP security header that limits where scripts, styles, images, frames, and other resources may load from. This warning belongs to browser-side application hardening.
Why does it matter?
A useful CSP reduces the impact of cross-site scripting and content injection bugs. It can stop injected code from loading external scripts, framing sensitive pages, or sending data to unexpected origins. Missing CSP does not prove the site is vulnerable, but it removes an important browser defense.
How to fix it?
Start with a report-only policy, review violations, then enforce a policy that matches the application.
Content-Security-Policy-Report-Only: default-src 'self'; report-uri https://reports.example.com/cspA simple enforced baseline for a mostly self-hosted site can look like this:
Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'self'Avoid broad wildcards and unsafe-inline where possible. Add trusted third-party domains only when the application actually needs them.