Matan · Security · Headers
CSP quality (Security)
A CSP that allows unsafe-inline, unsafe-eval or * is much weaker than it looks.
Pass condition in our engine: CSP is present and does not include the common weakness patterns we detect.
This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.
1. Problem description
We flag common weaknesses: unsafe-inline/eval on script, wildcard sources, missing object-src 'none', missing default-src/script-src. Passing CSP-present but failing this check means you have a header that does not really constrain scripts.
2. Most common causes
- A blog post’s example policy copied wholesale.
- GTM requiring unsafe-inline.
- object-src omitted.
3. How to fix it
- Remove unsafe-inline/eval; use nonces or hashes.
- Set object-src 'none'.
- Avoid * in script-src; list the CDNs you actually use.
Test this check
We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.
Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.
Get your free website audit
Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.