Check 21 of 54 · Web and TLS
A rulebook for what code may run on your pages, graded for obvious holes.
Engine 1.57.0, read 25 October 2026
Is your website set up safely?
The Content-Security-Policy header, read as current browsers apply it. It flags unsafe-inline, unsafe-eval, wildcard sources (such as * or https:) and a missing default-src. Browsers ignore unsafe-inline beside a nonce, a hash or strict-dynamic, and wildcards beside strict-dynamic in script-src, so neither counts there. A policy that sets script-src, object-src and base-uri needs no default-src.
A good policy is the strongest defence against injected scripts. A policy full of exceptions is a rulebook nobody follows.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Grades the shape of the policy on the landing page. It does not prove an attack would work.
Check 21 is one of 15 in Web and TLS. See it in its row on the scanner page, beside the rest of Web and TLS.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.