Your server does not send a Content-Security-Policy (CSP) header. CSP is one of the most effective defenses against cross-site scripting (XSS) and data injection attacks.
Add a Content-Security-Policy header starting with a report-only policy, then enforce.
Content-Security-Policy tells browsers which sources of content (scripts, styles, images) are allowed to load on your pages. Without it, browsers allow content from any source, making XSS attacks easier.
CSP is one of the strongest browser-side defenses against XSS. It prevents inline script injection, restricts content sources, and blocks mixed content. Recommended by OWASP and required by many compliance frameworks.
Deploy in report-only mode first to log violations without blocking anything.
# Nginx:
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri /csp-report" always;Monitor CSP violation reports. Each violation shows a resource that would be blocked. Add legitimate sources to your policy.
Add necessary sources for third-party scripts, styles, fonts, and images.
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://js.stripe.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://api.stripe.com; frame-src https://js.stripe.com https://challenges.cloudflare.comOnce confident the policy does not block legitimate resources, switch from report-only to enforcing.
add_header Content-Security-Policy-Report-Only "default-src 'self'; ..." always;add_header Content-Security-Policy "default-src 'self'; ..." always;Check that the CSP header is present and working.
curl -sI https://yourdomain.com | grep -i content-security-policyAfter making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.
A basic starting point: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;
'unsafe-inline' allows inline scripts or styles, weakening XSS protection. More secure alternatives are nonces (script-src 'nonce-random123') or hashes of specific inline scripts.
SPAs often need 'unsafe-inline' for styles and careful whitelisting of API endpoints in connect-src. Use nonces for inline scripts. Most frameworks (React, Next.js) can be configured for strict CSP.