A Content Security Policy (CSP) is a browser security policy usually delivered in an HTTP response header. It can restrict where a page loads scripts, styles, images, frames, and other resources from, helping reduce the impact of some injection attacks.
What does this finding mean?
If the report says the CSP header was not observed, the audited response did not expose that header to the checker. This is a hardening opportunity, not proof that the website has been hacked.
How to investigate
- Check the exact URL and response details in the report.
- Review response headers in browser developer tools or your hosting/CDN dashboard.
- Identify the scripts, styles, images, frames, and other resources your site needs.
- Where supported, start with a report-only policy to observe violations before enforcement.
- Build a policy for the site's real resource requirements and test key pages.
- Monitor for blocked legitimate functionality after deployment.
Important caution
There is no single CSP value that safely fits every website. A copied or overly restrictive policy may break checkout, analytics, embedded content, or other functionality. Ask your host or developer to configure and test it if you are unsure.