A content security policy limits which resources a browser is allowed to load. This reduces risks, but is more demanding in complex frontends than simple headers.
Content security policy is in place: 27 % (Average of domain values) from 68,464 evaluable domain values in the selected segment. The number describes the sample examined, not all websites or all URLs of these domains.
An existing content security policy is not automatically effective. The benchmark here assesses the presence of the header, not the rigor or completeness of its rules.
Many external resources can make the introduction of a CSP challenging. The indicator shows only its presence in the answer headers; the suitability of the rules is not evaluated.
The benchmark should not be read as a blanket must. However, it helps to make security debt visible and to classify the effort realistically.
The benchmark alone does not yet say which measure should be implemented first. In the website audit, the value is combined with URL type, severity, priority and specific findings.
Compare your own domainsecurity_csp checks content security policy in the response headers. An exclusively reporting Content Security Policy Report-Only should be distinguished from this.
A very open policy can count as existing, although it admits numerous sources. The same portion can therefore describe very different protective effects.
Capture required script, image and connection sources. Test changes with real-world features such as Checkout, Form and Consent banner.
A low value may show a lack of introduction. A high value does not replace the testing of directives or a functional test after changes.
A benchmark is a benchmark, not an absolute truth. Important is the deviation to the own website and the question of whether the signal for the affected pages is business relevant.
The baseline takes numerical metrics from the latest stored crawl per domain into account, if this was successful. Missing values do not enter as 0. Segments are only calculated from five available domain values. The selection is not a random sample and not a representative market share.
The current sampler selects up to ten URLs from sitemap or internal links; successful retrievals are combined into a domain mean for each metric. Older data sets can be based on a single page. In the case of shares, the page shows the mean value of the domain values, in the case of ALT coverage their median. Not all URLs of a website are examined.
Canonicals are a quiet but important indexing signal: they help search engines merge variants of a page cleanly.
SnippetsMeta descriptions are not a direct ranking lever, but they do influence how convincing a page is in the search result.
Structured dataStructured data makes content more explicit: organization, website, breadcrumbs, articles, products or local company data become easier to read for machines.
