Skip to content
Raptor home
Menu

Missing Content Security Policy

security.missing_csp
Priority
Note
Severity
Info

What we look for

These pages are served without a Content-Security-Policy header (a list of rules telling the browser which scripts and files the page may load).

Why it matters

Without it, a script an attacker manages to inject can run freely. It protects visitors but does not affect search results, so it costs no points.

How to fix

Add a Content-Security-Policy header in your server, CDN or hosting settings. Start in report-only mode to see what it would block before you enforce it.

Seen in a real crawl

From a crawl of Millbrook Hardware (the broken fixture), a test site from Raptor’s fixture suite.

Note

16 pages have no Content Security Policy

  • /Missing Content-Security-Policy header
  • /goneMissing Content-Security-Policy header
  • /missingMissing Content-Security-Policy header
First 3 of 16 addressesPaths on http://127.0.0.1:8001raptor 0.3.0, 17 Oct 2026

Open this finding in that crawl’s report

It also fired on Kestrel Bay Digital and the js-heavy fixture.

Where you’ll see it

The id is stable, and every surface uses it, so it’s the thing to search for or hand to an agent.

Terminal
When it is one of the five findings under Fix first, raptor crawl prints the id under it.
Check: security.missing_csp
crawl.json and the CSV
The crawl JSON names the finding by this id, and so do the CSV and raptor_query.
"check_id": "security.missing_csp"
The HTML report
This link opens the finding in the report, and each finding shows its id.
crawl.html#finding=security.missing_csp
MCP
raptor_findings with this check_id returns the finding in full, with a fix brief ready to paste into a task. If it didn’t fire, it says why.
raptor_findings {
  "job_id": "...",
  "check_id": "security.missing_csp"
}