How to Fix Missing Content-Security-Policy (CSP) Headers

The Threat of Missing CSP Headers

Without a proper Content-Security-Policy (CSP), your web application is highly vulnerable to Cross-Site Scripting (XSS) attacks. Attackers can inject malicious scripts into your site, stealing user sessions or redirecting traffic.

What is Content-Security-Policy?

CSP is an added layer of security that helps to detect and mitigate certain types of attacks, including XSS and data injection attacks. It allows site administrators to declare approved sources of content that the browser may load.

How to Implement CSP

Nginx Configuration

add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://trustedcdn.com;";

Express (Node.js) via Helmet

const helmet = require('helmet');
app.use(
  helmet.contentSecurityPolicy({
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "https://trustedcdn.com"],
    },
  })
);
      

Using FortPilot Pro, you can instantly scan your website to see if your CSP headers are correctly configured and preventing third-party script injections.