Content-Security-Policy header missing — the fix
This site does not send a Content-Security-Policy (CSP) HTTP header. CSP restricts which sources the browser can load scripts, styles, images, and other resources from, providing strong protection against cross-site scripting (XSS) attacks.
Where this fits: security in SEO
Security issues erode both rankings and trust. HTTPS has been a ranking signal since 2014, and browsers actively warn users away from insecure or mixed-content pages — a warning interstitial is a 100% bounce rate. Missing security headers rarely block indexing, but they widen your attack surface, and a hacked site (injected spam, malicious redirects) can be removed from results entirely. Security is the SEO work you do so you never have to do recovery work.
Why content-security-policy header missing hurts your rankings
Without CSP, the page is more vulnerable to XSS attacks, where attackers inject malicious scripts that can steal user data, session tokens, or redirect users to phishing sites. While CSP is not a direct SEO ranking factor, a security breach can lead to your site being flagged as malicious by Google Safe Browsing, which results in dramatic traffic loss and a warning interstitial in Chrome. Prevention is far easier than recovery.
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site.
How to fix it
Implement a Content-Security-Policy header that restricts resource loading to trusted sources. Start with a report-only policy (Content-Security-Policy-Report-Only) to identify violations before enforcing. Use nonces or hashes for inline scripts rather than 'unsafe-inline'.
# Basic CSP header
Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;
# Report-only mode for testing
Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report-endpointSecurity best practices
- Serve everything over HTTPS and redirect HTTP with a single 301.
- Send HSTS, X-Content-Type-Options, and a Content-Security-Policy on every response.
- Eliminate mixed content — one insecure asset breaks the padlock.
- Keep dependencies and CMS plugins patched; most site hacks are known-CVE exploits.
- Monitor Search Console's security section — Google often knows you're hacked before you do.
The full library: SEO best practices, by category.
Frequently asked questions
What does "Content-Security-Policy header missing" mean?
This site does not send a Content-Security-Policy (CSP) HTTP header. CSP restricts which sources the browser can load scripts, styles, images, and other resources from, providing strong protection against cross-site scripting (XSS) attacks.
Why does content-security-policy header missing matter for SEO?
Without CSP, the page is more vulnerable to XSS attacks, where attackers inject malicious scripts that can steal user data, session tokens, or redirect users to phishing sites. While CSP is not a direct SEO ranking factor, a security breach can lead to your site being flagged as malicious by Google Safe Browsing, which results in dramatic traffic loss and a warning interstitial in Chrome. Prevention is far easier than recovery.
How do I fix content-security-policy header missing?
Implement a Content-Security-Policy header that restricts resource loading to trusted sources. Start with a report-only policy (Content-Security-Policy-Report-Only) to identify violations before enforcing. Use nonces or hashes for inline scripts rather than 'unsafe-inline'.
How serious is this issue?
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects content-security-policy header missing on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by content-security-policy header missing, and hands you a ready-made fix task.
Check my site free