Optional hardening

Your site has no list of what scripts are allowed to run

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

There is no Content Security Policy. Any script that gets onto a page, from any source, is allowed to run.

Why it matters

This is the single setting that most limits the damage if a plugin, ad, or comment ever injects code.

How to fix it

Send the technical line below to whoever runs your site. Each of these is a one-line change in the server or hosting settings, and none of them changes how the site looks.

For your developer