Content-Security-Policy
What it can report
- ! medium no Content-Security-Policy at all How to fix it
- ! low only Content-Security-Policy-Report-Only is sent How to fix it
- ! low the policy comes only from <meta http-equiv> How to fix it
- ! medium nothing restricts scripts (low for a policy with no fetch directives) How to fix it
- ! medium 'unsafe-inline' without nonce, hash or 'strict-dynamic' How to fix it
- ! low 'unsafe-eval' in script-src How to fix it
- ✗ high script-src allows * / http: / data: (medium for https: only) How to fix it
- ! low object-src not restricted How to fix it
- ! low no base-uri How to fix it
- · info 'unsafe-inline' in style-src How to fix it
- ! low unknown directive or unquoted keyword How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 4 within Security. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.