www.cleanairgroupdallas.org

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Evidence and check scope

Configured:

No

Response inspected:

Homepage HTML response

Host requested:

www.cleanairgroupdallas.org

Host observed:

cleanairgroupdallas.org

References

Why it matters

DMARC lets the domain owner tell receiving services what to do when the visible From address is not verified by SPF or DKIM. Without DMARC, attackers have more opportunity to impersonate the domain in phishing email.

What to do

Publish a DMARC record at _dmarc, begin by collecting reports, and confirm that legitimate senders pass before applying a blocking policy.

Why it matters

Another website can place this page inside a hidden or misleading frame and trick a user into clicking an unintended action. Frame restrictions tell browsers which sites, if any, may embed the page.

What to do

Set frame-ancestors in CSP to the required trusted sites, and keep X-Frame-Options for older browsers when appropriate.