Check a site for a Content-Security-Policy
A Content-Security-Policy (CSP) is a response header that lists which sources a page may load scripts, styles, and other content from. A good one is the strongest single defense against cross-site scripting, because injected code from a source the policy does not list simply will not run.
What it costs
On CheckWeb this is a weight-1 check on the Security axis, weighted lightly on purpose. A correct CSP is genuinely hard to author and is absent on a large share of even well-run sites, so CheckWeb treats a missing policy as a real gap worth closing rather than an alarm that tanks the score. It shows as a warning, not a hard fail.
How it looks in the report
Under the Security axis, this shows as "Content-Security-Policy" with a WARN status and "No Content-Security-Policy header" when absent. A site that sends a policy shows PASS.
Content-Security-Policy
No Content-Security-Policy header
Missing vs set
Missing
An injected `<script>` from any origin runs with the page's full privileges.
Set
A policy that restricts script sources to a known list. A policy that keeps `unsafe-inline` for scripts undercuts most of the benefit, so the goal is a policy without it.
How to fix it
- Start in report-only mode: `Content-Security-Policy-Report-Only` surfaces what a policy would block without breaking the page, so violations can be fixed first.
- Tighten until the report is clean, then switch the header to `Content-Security-Policy` to enforce it.
- Set it at any layer that sends response headers (Nginx, Apache, app middleware, or the edge).
- Then verify: re-scan.
Check a site for a CSP
Paste a URL to see whether a site sets a Content-Security-Policy. Fix, re-scan, and confirm.
Check my website