Headers Security
medium Severity
Free Check
Trusted Types Readiness (DOM XSS Protection)
Evaluates CSP require-trusted-types-for directive to prevent DOM-based XSS by enforcing typed objects.
Why It Matters
Trusted Types lock down dangerous DOM sinks (like element.innerHTML) so raw strings cannot be passed without sanitization policies.
How We Check This
We look for require-trusted-types-for 'script' in the Content-Security-Policy header.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
add_header Content-Security-Policy "require-trusted-types-for 'script'; trusted-types default;" always;
Frequently Asked Questions
What browsers support Trusted Types?
Chromium browsers (Chrome, Edge) support Trusted Types natively.