For MSPs and Web Agencies
Content-Security-Policy scanner
A Content-Security-Policy limits which scripts a browser will run. It is one of the most valuable headers and one of the easiest to get wrong.
What the scan reports
- Whether a CSP or CSP Report-Only header is present.
- Missing protections such as object-src and frame-ancestors.
- Why the gap matters and its potential business impact.
A safe way to roll out CSP
The remediation starts with a report-only policy so you can see what would be blocked before enforcing anything. Enforcing a strict policy without testing can break analytics, payment widgets and embedded content.
Frequently asked questions
Is unsafe-inline always a finding?
It weakens a policy considerably. Moving inline scripts to files or using nonces is the usual fix, but it needs testing on each website.