Matan · Security · Headers

Content-Security-Policy

CSP is the primary browser defence against XSS and unwanted embeds.

Pass condition in our engine: A Content-Security-Policy header is present.

1. Problem description

Without CSP, any injected script runs. A first policy can be Report-Only; production should send Content-Security-Policy. We do not execute the page — we only read the header.

2. Most common causes

  • SPA hosts that never added a header.
  • Fear of breaking inline scripts.
  • CSP only on a marketing subdomain.

3. How to fix it

  1. Start with default-src 'self'; object-src 'none'; base-uri 'self'.
  2. Move inline scripts to files or use nonces/hashes.
  3. Tighten img/font/connect-src as you learn the app’s sources.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Generate a free reportView sample report