Practical Security Guides For Your Team

Your web server is missing a simple one-line instruction that tells browsers how to handle the files it sends. Without it, some browsers may try to 'guess' what type of file they've received — and in certain situations, that guess could cause a harmless-looking file to be treated as executable code. Think of it like a label on a package: without it, the delivery driver has to guess what's inside.

Your website is missing a security instruction called a Content Security Policy (CSP). Think of it like a guest list for your website — it tells visitors' browsers which scripts and resources are allowed to run, and blocks everything else. Without it, your site is missing one layer of protection that could help limit the damage if another vulnerability were ever found.