The pasted Content-Security-Policy has no directives.

CSP_EMPTY_POLICY · Severity: Error

• ErrorCSP_EMPTY_POLICY

  The pasted Content-Security-Policy has no directives.

  After the optional header name nothing is left that reads as a directive, such as default-src 'self'. A browser treats an empty policy as no policy at all.

  Recommendation: Paste the header value, for example default-src 'self'.

Reported by

• CSP header parser

Available through the API

• CSP header parser API

Related findings

• Info CSP_DEPRECATED_DIRECTIVE The policy uses a directive that has been removed from CSP.
• Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
• Info CSP_NO_BASE_URI The policy does not restrict the base element (base-uri).
• Warning CSP_NO_DEFAULT_SRC The policy has no default-src directive.
• Warning CSP_NO_OBJECT_SRC Plugin content (object and embed elements) is not restricted.

All findings