Audit rules
Content Security Policy Missing
The page has no Content-Security-Policy, neither as a response header nor as a <meta http-equiv> element in <head> (a Report-Only policy does not enforce anything). In a QuikSEO audit, a failure has info severity and counts against the score. The exact condition, its exceptions and its sources follow below.
security.cspInfo01 — Definition
How This Rule Is Checked
The rule is a pure function of the fetched page: no extra requests, no account settings. The same input always gives the same result.
Rule Severity and Score
- Rule id
security.csp- Group
- Security
- Severity of a failure
- Info
- Counts in the score
- Yes, whenever it applies to the page
- Required for a score
- No
- Replaces the check
csp
Condition and Exceptions
- Condition
- No Content-Security-Policy header and no <meta http-equiv="Content-Security-Policy"> in <head> → fail (info)
- Exceptions
- A meta policy passes with the delivery method in the evidence; HTML mode without a meta policy → not_checked
Sources and Project Decision
- Project decision
- A policy in <meta http-equiv="Content-Security-Policy"> inside <head> counts as present, as browsers enforce it; the evidence names the delivery method.
02 — Security
Other Rules in This Group
The other checks of the same group, each with its own condition and sources.
- X-Content-Type-Options Missingsecurity.content_type_options
- Framing Protection Missingsecurity.frame_protection
- HSTS Missingsecurity.hsts
- Permissions Policy Missingsecurity.permissions_policy
- Referrer Policy Missingsecurity.referrer_policy
- Flagged by Safe Browsingsecurity.safe_browsing
- Form Submits Over HTTPsecurity.unsafe_forms