Your pages are missing a security header
A scan that names Content-Security-Policy or HSTS is not a broken tag. What those headers do, how stores usually add them, and how to confirm.
Last reviewed September 2026.
What the finding is saying
The scanner asked for a page and looked at the HTTP headers on the response. It records two:Content-Security-Policy and Strict-Transport-Security. If either is absent, you get a note on that page type. Your tags can still be firing. A missing header is a separate fact from a pixel that loaded and never sent an event.
The sentence names the header. “Your cart pages are served without a content-security-policy header” means the cart HTML arrived with no CSP. It does not mean the cart pixel is broken.
What Content-Security-Policy does
CSP tells the browser which scripts, styles, images and frames that page is allowed to load. Without it, a script that someone else managed to inject — a compromised plugin, a bad tag manager container, a support extension — can run as easily as your own. With it, the browser refuses origins you did not list.
Do not paste a policy from a blog. A list that omits your theme CDN, your tag hosts, or your checkout frames will blank the store. SendContent-Security-Policy-Report-Only first, watch the reports for a few days, then switch to an enforcing Content-Security-Policy once the list matches what the pages actually load.
Woo and other self-hosted stores usually set this on the origin (the host, LiteSpeed, nginx) or as a Cloudflare Transform Rule. Shopify themes cannot set arbitrary response headers on every storefront page; the CSP you can add is the one Shopify and your apps already emit. If the scan still sees none, that is often the platform, not a setting you missed.
What Strict-Transport-Security does
HSTS tells the browser to use HTTPS on the next visit, even if the visitor typeshttp://. Add it only after every hostname — apex, www, and any checkout host you control — already serves a valid certificate. A max-age of a year is the usual production value; start shorter while you are sure nothing still needs HTTP.
What you do not need to do today
You do not need to pause ads, rewrite the theme, or treat this as a broken pixel. If you are choosing an integrity method for payment pages later,PCI 11.6.1 cares about headers as the browser received them. A missing CSP is useful context for that choice. It is not a tag that stopped firing.
A script without SRI is the other common note on the same report.
Confirm it with a scan
Four page types, a real browser, no account. A scan will not fix the tag. It will tell you whether it is firing now.