How to Fix a Missing CSP Header

A missing CSP header is one of the most common findings in a website security scan, and one of the most worthwhile to fix. When your site does not send a Content-Security-Policy header, the browser has no allowlist to enforce, so any script that reaches the page, including one injected by an attacker, is free to run. This guide explains how to fix a missing CSP header on any stack, step by step, and how to confirm the fix actually worked.

What a missing CSP header means

The scanner checked your HTTP responses for the Content-Security-Policy header and did not find one. That is what a missing CSP header is: the page loads normally, but there is no policy telling the browser which scripts, styles and other resources it may trust. The practical risk is cross-site scripting, where malicious code injected through a plugin, theme or form runs with the full trust of your domain. Because the browser cannot tell your code from an attacker’s, a single injected script can steal sessions, capture form data or redirect your visitors. If you want the background first, see our explainer on what a Content Security Policy is.

Step 1: Choose a starting policy

Begin with something conservative such as default-src ‘self’; object-src ‘none’; frame-ancestors ‘self’. This allows resources only from your own domain and blocks framing and legacy plugins. Roll it out in report-only mode first, using the Content-Security-Policy-Report-Only header, so you can watch for broken features against real traffic before enforcing anything. Rushing straight to a strict enforced policy is the fastest way to break your own site.

Step 2: Add the header on your server

Apache

Add this line to your .htaccess or virtual host, wrapping the policy value in quotes: Header always set Content-Security-Policy "default-src 'self'". Apache then sends the header on every response.

Nginx

Inside the relevant server or location block add add_header Content-Security-Policy "default-src 'self'" always; and reload Nginx so the change takes effect.

WordPress

If you cannot edit the server config, hook into WordPress and send the header from PHP using the send_headers action, or use a reputable security-headers plugin. A single header line resolves the missing CSP header for every page on the site at once.

What a good policy includes

Once the header is present, its quality matters as much as its existence. A protective Content-Security-Policy usually names an explicit script-src rather than relying on default-src alone, avoids the unsafe-inline and unsafe-eval keywords wherever possible, and sets frame-ancestors to stop clickjacking. Adding a report-uri or report-to endpoint gives you ongoing visibility of violations even after enforcement.

Common mistakes when fixing a missing CSP header

• Using a wildcard source such as script-src *, which technically adds the header but provides almost no protection.
• Leaving unsafe-inline in place, which re-opens the exact cross-site scripting hole the policy is meant to close.
• Setting the header on only one page instead of site-wide, so most of the site remains exposed.
• Never re-testing, so a typo that voids the whole policy goes unnoticed.

Step 3: Move from report-only to enforced

Once your reports show no legitimate resources being blocked, switch the header name from Content-Security-Policy-Report-Only to Content-Security-Policy. The policy is now enforced and the missing CSP header finding is resolved.

Step 4: Re-scan to confirm the fix

After deploying, confirm the header is genuinely being sent and is well-formed. Run a security scan with EzyAudit AI and check that the Content-Security-Policy header now appears and grades well. Our scanner rates the policy strength, not just its presence, so you can tell a real defence from a placeholder. Review the full list of checks to see everything else we test. For directive syntax and browser behaviour, the MDN reference for Content-Security-Policy is the authoritative guide.

Fixing a missing CSP header takes minutes and closes one of the widest doors on your site. Scan your website now to confirm your headers are in place and correctly configured.