Default index.hmlt page not working wiht "Adding security headers to get A+ rating"

[bcx]

So I followed this guide:
https://docs.directadmin.com/webser....html#adding-security-headers-to-get-a-rating

And went from B to A

Scan results for myedgy.com

These are the scan results for myedgy.com which scored the grade F.

securityheaders.com

However, when you add a new domain name in your DirectAdmin page it creates a default index.html file.
But that seems to be messed up now. How can this be fixed, or is this a bug?
http://www.myedgy.com/

In the console window I noticed this errors:


Thank you in advance, because I can't find how to solve the default template. It seems the CSS is not getting read.

 

[BillyS]

What is your question? The error tells you exactly how to solve the problem. See here (which is basically the same explanation):

CSP: style-src - HTTP | MDN

The HTTP Content-Security-Policy (CSP) style-src directive specifies valid sources for stylesheets.

developer.mozilla.org

It's not a DA bug. The instructions you followed should give you an A+ rating if the code on the site conforms to the standard. Looks like whatever template you are using does not. If you want it to work, you have to follow the instructions in the error.

 

[bcx]

Yes i've read a few articles too. Is it not weird that even the latest default worpdress template is not compatible?
It all give these notification in the console window.

I don't know how to fix it, because If i modify a whole theme now. It will be okay.. until an update comes out of the theme and i will be probably back at square one.

ps: I've tested a couple of themes they all have the same. While some of them are from very good developers.

 

[BillyS]

It's a balance between speed, security, and ease of writing the theme. Loading javascript from other sources can speed up a site, but make it less secure. Doing inline styling makes the theme more efficient in terms of resources it needs to load to render the page. In our case, rather than modifying the theme we gave up and added

Content-Security-Policy: style-src 'unsafe-inline' 'unsafe-eval';

 

[johannes]

If i modify a whole theme now. It will be okay.. until an update comes out

Use a child theme, then the updates dont change the stuff in your childtheme. You can do that manual or with plugins.