Post cover image

November 5, 2026

Missing Content-Security-Policy: What It Means and What to Check Next

A plain-language check for the CSP header, Report-Only vs enforce, and a short story of how CSP can stop an injected script.

By HackerMe

2 min read

If you run a small site or a marketing site in front of a product, you may have never typed "Content-Security-Policy" into a config file. Automated reports still call out a missing CSP header. That can sound like the site is broken. The finding alone does not mean the site was hacked. It means the page is missing a browser rule that limits where scripts and other resources may load from.

Think of CSP as instructions to the visitor's browser: which script hosts are allowed, whether inline script may run, whether the page can be framed. MDN's CSP guide puts XSS mitigation first. OWASP stresses that you still need to write the application carefully; CSP is a second layer.

A short scenario

A comment field reflects unsanitized input into the page. An attacker leaves markup that loads https://evil.example/x.js (or an inline script). Without CSP—or with a policy that still allows almost any script—the browser may run that code for every visitor. A suitable enforced CSP that blocks inline scripts and limits script sources to trusted origins (or uses nonces/hashes) can stop the browser from executing that injection even when the markup still reaches the page. CSP does not fix the injection bug; it narrows what the browser will run.

A five-minute outside check

From a terminal (follow redirects; test the final URL):

curl -sL -D headers.txt -o page.html -w 'final_url=%{url_effective}\n' https://your-domain.com/
head -1 headers.txt
grep -i '^content-security-policy:' headers.txt
grep -i '^content-security-policy-report-only:' headers.txt

What you want eventually is a Content-Security-Policy: line on the HTTPS page people actually use.

  • No Content-Security-Policy: line: no enforced policy was found in the response headers; also check the HTML for a meta CSP tag.
  • Only Content-Security-Policy-Report-Only: the browser is not blocking yet — that mode is for learning. Review what would be blocked; Report-Only itself does not break the site.
  • Prefer the HTTP header over a meta tag when you need framing controls or reporting.

Repeat the check on /login or another page that holds a session. Homepages and app pages often disagree.

"We have a CSP" can still be a soft CSP

When a header exists, open it. If scripts are allowed from almost anywhere, or inline script is still allowed without a nonce or hash, much of the XSS benefit is gone. A missing object-src line alone is not proof of weakness — it can fall back to the default rule.

You do not need a perfect policy on day one. You do need to know whether you have none, report-only, or a policy that still trusts almost everything.

How teams usually roll it out

  1. Add Report-Only and review what would be blocked in the browser console.
  2. Fix legitimate scripts and styles (or allow them deliberately).
  3. Switch to an enforced Content-Security-Policy header.
  4. Prefer the HTTP header over a meta tag when you need framing controls or reporting.

A basic same-origin starting point from OWASP looks like:

Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; form-action 'self';

This is only a starting example. It is not a ready setting for every site, it may block existing pieces of the page, and it is not a Strict CSP. Test it first as Report-Only on staging.

What this never proves

A CSP on the pages you tested does not mean the site has no bugs, no malware, and no bad plugins. It means the browser got a policy for those responses. Outside scanners — including ours — only see what the site returns.

About us

We build HackerMe, an automated website security scanner by Agura / OMC Group. Security headers run on every website scan; a sample finding we show publicly is "Missing Content-Security-Policy header." Deeper CSP analysis can check policy quality on Standard and higher scan types. HackerMe offers a free scan on a domain you own or have explicit permission to test: https://brandingme.ai/app/r/Xf3JFiq6lABO98_rFGscxQ

Sources