Checks · security

Missing Content-Security-Policy Header

Opportunity security.missing_csp

What it means

The page sends no Content-Security-Policy, the main defence against injected scripts.

How to fix it

Start with a report-only policy to see what would break, then enforce it.

Where to find it in Truelint

Open the Issues pane on the right of the workspace and select Missing Content-Security-Policy Header. The grid filters to every affected URL and the detail pane shows the specific finding for each. Export the list with Export → Current view, or from the API:

GET /api/v1/crawls/{handle}/issues/security.missing_csp