Protocol: Missing Content Security Policy Header¶

Identifier: csp_missing

Scanner(s) Support¶

Description¶

A missing Content-Security-Policy header leaves the browser without declarative restrictions on which scripts, styles, and other resources may load or execute on a page. Without CSP, injected malicious content is far more likely to run, increasing the risk of cross-site scripting and related client-side attacks.

How we test: We inspect HTTP response headers on HTML-serving endpoints and flag responses that do not include a Content-Security-Policy header (or an equivalent policy delivered via a meta tag when headers are unavailable).

References:

• OWASP Content Security Policy Cheat Sheet
• OWASP Security Misconfiguration (A02:2025)
• OWASP Web Security Testing Guide: Test for Content Security Policy

Configuration¶

Example¶

Example configuration:

---
security_tests:
  csp_missing:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.