CSP Evaluator

How it works

Content-Security-Policy is the browser's primary guardrail against injected script. This tool fetches your public URL (SSRF-safe), reads the CSP header if present, and parses directives for obvious weak spots: 'unsafe-inline', 'unsafe-eval', broad wildcards, and missing default-src or script-src. A strong CSP is hard to get right on modern SPAs, so many sites either omit it or ship a permissive policy that looks present but barely constrains XSS. Our teaser score rewards policies that avoid the classic foot-guns and notes when core script controls are absent. We also surface object-src guidance when default-src is missing. What we do not do: execute the page in a real browser, evaluate nonce/hash correctness, or simulate every CSP Level 3 edge case. Report-Only headers, meta-tag policies, and path-specific policies may not appear on the single response we fetch. Treat findings as a punch list for your next deploy, not a certificate of safety. After you tighten CSP, re-run this checker, then use AtRisk for a broader URL scan that correlates front-end posture with other detectors. Founders who ship with Cursor, Lovable, or Bolt often inherit template CSP - or none at all - so a two-minute parse here prevents a painful production surprise.

This is a free teaser check - not a penetration test, vulnerability assessment, or compliance audit. AtRisk full scans go deeper across more detectors and unlock fix prompts on Starter.