How to fix missing content security policy on WooCommerce

Steps for WooCommerce

1. Install the free 'HTTP Headers' plugin by BTC (available on WordPress.org plugin repository) or the 'Headers Security Advanced & HSTS WP' plugin.
2. In WordPress admin, go to Settings → HTTP Headers (or the plugin's menu item), find the Content-Security-Policy field, and enter your policy string.
3. Alternatively, add the header via your theme's functions.php or a custom plugin using the send_headers action hook: add_action('send_headers', function(){ header("Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"); });
4. If your host gives you access to Apache, add the header in .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"
5. If your host uses Nginx, add add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always; inside the relevant server {} block in your Nginx config.
6. Verify in browser DevTools → Network → select a page → Response Headers.

What is missing content security policy?

A Content Security Policy (CSP) is an instruction you send to your visitors' web browsers, embedded in a special HTTP header, that tells the browser exactly which sources of scripts, images, styles, fonts, and other content it is allowed to load on your site. Think of it as a strict guest list at a nightclub door: anything not on the list gets turned away. Without a CSP header, the browser will happily load resources from anywhere — including malicious scripts injected by attackers. Your site currently sends no CSP header at all, which means that protection layer is completely absent.

Without a CSP, your store is significantly more vulnerable to Cross-Site Scripting (XSS) attacks — one of the most common ways attackers steal customer data, hijack sessions, or install payment-skimming code (like Magecart) directly in your shoppers' browsers. A successful XSS attack can expose customers' credit card numbers, passwords, and personal information, leading to chargebacks, fines under GDPR/CCPA, PCI-DSS violations, and severe reputational damage. Google also considers site security as a ranking signal, so a visibly compromised site can lose organic search rankings fast. Adding a CSP is recognized by OWASP as a critical defense-in-depth control against injection attacks (A03:2021).

See the complete Missing content security policy guide for every platform and the full background.