Missing or weak Content-Security-Policy

Why it matters

Without a CSP, one injected script can run with full access to your users' sessions.

How to fix it

Add a Content-Security-Policy header. Start in Report-Only mode, then enforce.

How we test it

Passive — runs in the free check, looks only at what a browser can see.