snag.page

Every check ยท Headers

Content-Security-Policy

headers/csp

What it checks

The Content-Security-Policy header, and whether it limits scripts.

Why it matters

A CSP stops a script injected into a page from running: the main defence against cross-site scripting.

How to fix it

  1. Send a policy as Content-Security-Policy-Report-Only first, and see what it would block.
  2. Add the sources your pages need.
  3. Then send it as Content-Security-Policy, without 'unsafe-inline' in script-src.
Header
Content-Security-Policy-Report-Only: default-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'

Check a site for this and everything else: snag.page. More on headers: Bot challenge Framing nosniff Referrer policy Software versions End-of-life software CORS Permissions-Policy Cross-Origin-Opener-Policy