Kazap TechnologiesYLB ScoreYour Local Business Score

YLB Score › The checks, explained › Part III, Will a stranger trust you?

Nothing limits what can run on your pages

If anything malicious ever got onto your site, through a plugin or a stolen password, there is nothing stopping it running in your visitors' browsers. One setting lists what is allowed to run, and blocks the rest.

It takes care to set up without breaking things, which is why most sites have not. Start in the mode that only reports.

Worth about 2 points of your 100 for a typical businessAbout 1 hour, by your web person

See for yourself

securityheaders.com will show whether a Content-Security-Policy is present.

How to fix it

  1. Have your web person add the policy in report-only mode first.
  2. Fix what it reports, then enforce it.
The technical version, for your web person

CSP. The Content-Security-Policy response header. We check presence only; a weak policy still earns the mark, which is honest about what we can measure from outside.

What the check reads. Presence of the Content-Security-Policy response header.

This is one of the checks in a YLB Score report. Every report is free, read by a person before it goes out, and written so that you can act on it without us. Ask for yours.