Readiness check · Harden lane · weight 4

Content Security Policy present

Next.js: Next.js documents nonce-based CSP with middleware.
Drupal: The Security Kit module includes CSP settings.

The homepage sends a Content-Security-Policy header.

Why it matters

A CSP limits where scripts, styles and frames can load from, which reduces the impact of injected or compromised third-party code.

Start with Content-Security-Policy-Report-Only to see what would break, tighten the policy over a few weeks, then enforce it.

The homepage sends a Content-Security-Policy header.

Observed: Content-Security-Policy present.

Not observed: No Content-Security-Policy header.

Limit: Read from the homepage response only; other pages or regions may send different headers.