🔒
AB-098
Content-Security-Policy header
What it means
Your homepage returns a Content-Security-Policy header.
Why it matters
CSP prevents XSS and data injection attacks by restricting resource sources. Critical for agent security when loading external scripts.
✗
What's wrong
No Content-Security-Policy header on responses.
✓
What's right
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Check this rule on your site
Enter your URL to check just this one rule (AB-001).