Security headers

Set a content security policy

Why this matters

A content security policy limits where a page can load scripts and other files from. It helps limit harmful code added to a page.

What to do

1. Ask whoever maintains your site to list the scripts and other files the page needs, including those used by forms and payment tools.
2. Have them design a Content-Security-Policy response header for your site. A response header is an instruction the server sends with the page. On an existing site, start with Content-Security-Policy-Report-Only to check for breakage before enforcing the policy.
3. What to tell your web developer: Please create and test a suitable content security policy. Review reports, then enforce it using Content-Security-Policy. Report-only mode alone will not pass this check. Start strict on a new site.

How to check the fix

After the policy is enforced, test menus, forms and other important features. Run the checker again. It checks that a policy is present, not how strong it is.