Skip to content

Security

How to add a Content-Security-Policy

CSP limits the damage when a script you did not intend ends up on the page — from a compromised dependency, an injected comment, or a third-party tag. Without it, any injected script has the same access as your own code. Report-only mode blocks nothing; it is a staging state.

What 13x checks

This is rule security.csp in the public registry: Content-Security-Policy is set. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Security
Score weight
7 of the readiness score
Scope
Runs on every audited page
Applies
To every site

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Add a Content-Security-Policy. Start in report-only so you can see what it would break:

Configuration
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'

Watch the console for violations, add the origins you actually need, then switch the header to Content-Security-Policy to enforce it.

Notes on the hard parts:

- style-src 'unsafe-inline' is usually unavoidable with CSS-in-JS and is a much smaller risk than the script equivalent. - script-src 'unsafe-inline' defeats most of the point. If you need inline scripts, use a nonce instead. - frame-ancestors 'none' replaces X-Frame-Options. - form-action 'self' stops an injected form posting your users' input somewhere else — cheap and often forgotten.

Framework-specific versions

Where the change differs enough to be worth writing out separately.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More security checks