FmindSecurity guide
Protection against malicious scripts (CSP)
A Content Security Policy tells browsers which scripts and resources your site may load. Without one, malicious code slipped into your site (for example through a vulnerable plugin) runs freely in your visitors’ browsers and can steal what they type.
Who can help
Your web developer
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- Check both Content-Security-Policy and Content-Security-Policy-Report-Only on the HTTPS homepage. With your developer, list the scripts, frames, fonts and connections the site needs before drafting a report-only policy, and choose a report address that you approve.
Existing enforced policy: RECORD
Existing Report-Only policy: RECORD
Required resources and essential journeys: INVENTORY
Report destination and retention: OWNER_APPROVALWhat to do
This needs care, because a policy that is too strict can break your site. Ask your developer to list the scripts, fonts and services your site uses (analytics, payments, chat), then test a policy in “report-only” mode, which reports problems without blocking anything. Switch to enforcement only once your key pages work, and keep the previous setting ready to restore.
How to verify the change
Run this check again: this item should show Good. Then test your key pages (contact form, checkout, booking) to make sure nothing broke.
What this check can establish
We check that your homepage sends an enforced policy that limits scripts, without 'unsafe-inline' or wildcard sources. Having one does not prove that it is complete or that your site cannot be attacked.