Content-Security-Policy Header is Missing

Description

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware. ^Mozilla

Recommendation

Configure your server to send this header for all pages. You can see references for possible values.

References

• Mozilla: Web Security
• Mozilla: Content Security Policy (CSP)