What it is

There's no Content-Security-Policy header. This header is an extra layer of defense that limits which scripts, styles and resources a page is allowed to load — without it, an injected malicious script has an easier time running unrestricted if the site is ever compromised.

How to fix it

Add a Content-Security-Policy header appropriate for your site's scripts, styles and embeds. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

Your WordPress site is missing an invisible security rule called a Content Security Policy, which acts like a bouncer that decides what code is allowed to run on your website. Think of it this way: if someone bad manages to sneak malicious code onto your site, this policy would stop most of that code from actually executing and causing damage. Without it, harmful scripts have a much easier time running freely and stealing visitor information or spreading malware. The good news is that fixing this is straightforward and doesn't require technical knowledge. You can install a WordPress security plugin like Wordfence, All In One WP Security, or iThemes Security, go to its security settings, and enable the Content Security Policy option, which will automatically apply the proper rules to your site. The plugin handles all the complicated technical details behind the scenes, so you just need to check a box and activate it. This is definitely worth doing because it's one of the easiest and most effective ways to harden your site's defenses.