What the issue means
A missing CSP header means the browser has fewer instructions for controlling scripts, frames, images, and other resources.
Security fix guide
How to Fix a Missing Content Security Policy Header
A missing CSP header means the browser has fewer instructions for controlling scripts, frames, images, and other resources.
Run Full Website Security ScanWhy it matters
Content Security Policy can reduce the impact of cross-site scripting and content injection when it is carefully configured.
How to check it
Check your response headers for Content-Security-Policy using a browser network panel, curl, or ZeriFlow's security headers checker.
How to fix it
Start with a report-only policy, review violations, then enforce a policy that matches your application assets.
Configuration examples
Nginx
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self';" always;Apache
Header always set Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self';"Vercel / Next.js
headers: async () => [{ source: "/(.*)", headers: [{ key: "Content-Security-Policy", value: "default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self';" }] }]Cloudflare
Use Transform Rules or Response Header Modification to add a CSP header at the edge.