agentsiteaudit · Checks · Security

Content Security Policy: a safety net against injected scripts

A Content Security Policy (CSP) is a header your server sends with each page, listing where scripts, styles, images and other files may come from. If an attacker manages to slip a script into your page, the browser refuses to run it because it is not on the list.

Our check passes when a policy is in force, warns when it is only in report-only mode, and fails when there is none.

In our November 2026 study of businesses selling to AI agents, 67% of the 1,190 websites we checked sent no Content Security Policy, or only a report-only one. See the full study.

Why it matters

Most websites load code from several places: plugins, analytics, chat widgets, payment forms. A CSP limits the damage if any one of them, or a form on your site, is used to inject something harmful.

What our check looks for

• Pass: Content-Security-Policy present
• Warning: Report-only only
• Fail: Missing

Check ID security.csp.present · Security · Medium priority

How to fix it

Step 1: report only (safe to try)

Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'

This blocks nothing. Open your site with the browser console open and note what it would have blocked, then add those sources.

Step 2: Apache or cPanel (.htaccess)

<IfModule mod_headers.c>
  Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"
</IfModule>

Add the sources your site really uses, for example a payment provider in script-src and frame-src.

Nginx

add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;

Put it in the server block for your site and reload Nginx.

Cloudflare

Rules > Transform Rules > Modify response header

Add a header called Content-Security-Policy with your policy as the value.

Common mistakes

• Switching straight to a strict policy, which breaks payment forms, maps or analytics.
• Adding 'unsafe-inline' and 'unsafe-eval' to script-src to make everything work, which removes most of the protection.
• Staying in report-only mode for ever, which protects nothing.
• Forgetting WordPress admin pages, which often need a looser policy than the public site.

Related checks

• Permissions-Policy: switch off browser features your site does not use
• HSTS: make browsers always use the secure version of your site

Written by Derek Moore, who builds and runs websites for small UK businesses. Last checked 30 October 2026.