Methodology
Content-Security-Policy
ia.csp · 5.4
Read
MUST
Recommendation
Why it matters
Content-Security-Policy prevents XSS and injection attacks. For AI agents that interact with your site, CSP ensures the page content hasn't been tampered with by malicious scripts.
How to fix it
Send a Content-Security-Policy header with default-src and script-src.
-
Start with a report-only policy and collect the violations.
-
Send the enforced policy when the violations are fixed.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
Verify
curl -sI https://{domain}/
Expected: A Content-Security-Policy header
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.csp
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- MDN: Content Security Policy
- Score role
- Core
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22