Loading…
Loading…
Enter a URL and we fetch its live Content-Security-Policy, score it out of 100 and list the fixes in order. Or paste a policy before you ship it. Free, no sign-up.
We read the policy your server actually sends, not the one in your config file, and grade it the way browsers enforce it. The enforced and the Report-Only policy are scored separately, because a Report-Only policy blocks nothing on its own.
<script> tag on each response.'strict-dynamic' lets those scripts load others, so you skip host lists.Report-Only first, then enforce once reports are clean.Content-Security-Policy:
script-src 'nonce-{RANDOM}' 'strict-dynamic' https:;
object-src 'none';
base-uri 'none';
frame-ancestors 'self';
form-action 'self';
report-to cspOpen DevTools, go to the Network tab and reload. Select the first request, the page itself, and look for Content-Security-Policy and Content-Security-Policy-Report-Only in its response headers. A site can send one, the other, or both. From a terminal:
curl -sI https://example.com \ | grep -i content-security-policy
Use the URL scan when the policy is live, and paste mode for a draft or staging policy. For HSTS, X-Content-Type-Options, Permissions-Policy and the rest in one grade, run the security headers checker.
Enter the URL above. We fetch the page the way a browser does and read the Content-Security-Policy and Content-Security-Policy-Report-Only headers, plus any <meta http-equiv> policy in the HTML. You can also open DevTools, select the first request in the Network tab and look at its response headers.
The page sent no CSP header and has no <meta> policy. Common causes: the header is only set on some routes, a CDN or proxy strips it, or it is added by JavaScript after load, which browsers ignore. Turn off Follow redirects to see what the first response sends.
Most XSS works by injecting an inline <script> or an onclick= attribute. 'unsafe-inline' in script-src allows exactly that, so the policy no longer stops the most common attack. Add a nonce or hash instead; browsers then ignore 'unsafe-inline' and you can keep it as a fallback for very old browsers.
No. Content-Security-Policy-Report-Only only reports violations, it blocks nothing. It is the right way to test a new policy, but this checker scores the page as unprotected until the same policy is sent as Content-Security-Policy.
Each finding takes a share off a Security and a Quality score, both out of 100. High-severity security issues cost the most. A page that does not restrict scripts at all scores at most 15 for security, so a weak policy always ranks above none. The overall score weights security at 80% and quality at 20%, so tidy-up items never hide a real gap.
No. Pasted policies are scored in your browser and never leave the page. URL scans fetch only the public response every visitor gets, and we keep no copy of it.
CSP makes XSS harder to exploit. It does not find the XSS, the broken access control or the leaky API behind it. GhostProbe runs a full penetration test on your app and a person reviews every finding.