Missing Content-Security-Policy header

What it is

There's no Content-Security-Policy header. This header is an extra layer of defense that limits which scripts, styles and resources a page is allowed to load — without it, an injected malicious script has an easier time running unrestricted if the site is ever compromised.

How to fix it

Add a Content-Security-Policy header appropriate for your site's scripts, styles and embeds. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.