Missing Content-Security-Policy header

What does this mean?

This header tells the browser exactly which sources of scripts and content your site trusts. Without it, if an attacker manages to inject malicious code onto your site — through a vulnerable plugin or a compromised form, for example — the browser has no guardrails stopping it from running.

What are the potential impacts?

• A single vulnerable contact form, comment box, or outdated plugin becomes an open door for injected scripts that run in every visitor's browser, not just yours.
• Attackers can quietly log keystrokes on your site — including anything typed into a payment or login form — and send that data to a server you don't control.
• Malicious ads or "malvertising" injected this way can redirect visitors to scam pages, damaging trust in your brand even though the exploit happened on your site.
• Browsers and search engines can flag or blocklist a compromised site, which is far more disruptive to fix than adding one header upfront.