Content-Security-Policy missing

Scan.now reads the Content-Security-Policy header from the HTTPS response to /. If there is no header, it also looks for a <meta http-equiv="Content-Security-Policy"> element in the HTML, which browsers honour for most directives (but not frame-ancestors, report-uri or sandbox). The check passes when an enforced policy exists that constrains script execution through script-src or a default-src fallback. It fails when there is no policy at all, and it also fails, with an explanatory note, when only Content-Security-Policy-Report-Only is present, because a report-only policy blocks nothing. The quality of the directives (for example 'unsafe-inline' or wildcards) is assessed separately in csp-weak-directives, and clickjacking protection via frame-ancestors in x-frame-options.

Cross-site scripting remains one of the most common web vulnerabilities (OWASP Top 10:2021 folds it into A03 Injection). Output encoding is the primary defence, but a single missed sink in a template, a third-party widget or an old library is enough. A Content Security Policy is the second layer: even when an attacker manages to inject <script>, the browser refuses to execute anything that is not from an allowed source or carrying the right nonce. A realistic scenario is a comment field that escapes most characters but not an attribute context; without CSP the injected handler steals session tokens or silently rewrites a payment form (the Magecart pattern). CSP also governs where forms may post, which origins may frame the page, and whether plugins load. Our CSP guide and XSS guide go deeper.

Start in report-only mode, watch the reports for a few days, then enforce. A nonce-based "strict" policy is the modern recommendation because it does not depend on maintaining a host allowlist:

Content-Security-Policy: script-src 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests

The nonce must be fresh per response, so it is generated by the application rather than the web server. Express with Helmet:

app.use((req, res, next) => { res.locals.nonce = crypto.randomBytes(16).toString('base64'); next(); });
app.use(helmet.contentSecurityPolicy({
  directives: {
    scriptSrc: [(req, res) => `'nonce-${res.locals.nonce}'`, "'strict-dynamic'"],
    objectSrc: ["'none'"], baseUri: ["'none'"], frameAncestors: ["'self'"],
  },
}));

Static sites without inline scripts can use a simple allowlist set at the server. nginx:

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" always;

Apache: Header always set Content-Security-Policy "...". On Cloudflare, a Transform Rule (Rules > Transform Rules > Modify Response Header) adds the header at the edge. For rollout, send the same policy as Content-Security-Policy-Report-Only with a report-to directive and a Reporting-Endpoints header, fix what the reports show, then switch header names.