Is my Content Security Policy actually protecting my site?

Updated 2026-11-01

Short answer: a Content Security Policy (CSP) only protects you if it limits where scripts can come from. Many policies are there but let everything through. The common gaps: 'unsafe-inline' without a nonce or hash, so any script injected into the page runs; 'unsafe-eval'; scripts allowed from any website (* or https:); no script-src or default-src at all; or a policy sent only as Content-Security-Policy-Report-Only, which blocks nothing.

How to check it yourself

  1. Open your site, press F12, go to Network, reload, and click the first request (the page itself).
  2. Under Response Headers, find Content-Security-Policy. If you only see Content-Security-Policy-Report-Only, nothing is blocked.
  3. Read script-src (or default-src if there's no script-src) and look for the gaps above.

What Preventionlabs shows

The security section of every report reads the home page's Content Security Policy and names each of these gaps: no script limit, 'unsafe-inline' without a nonce, hash or 'strict-dynamic', 'unsafe-eval', scripts from any website, and report-only mode. When none apply, it says the policy limits where scripts can load from. It reads the policy itself; it doesn't test which of your own scripts the policy blocks.

Price

Free to sign up, with 2 free reports on each domain. Then US$28 a month for 1,500 credits.

Run your first report free