Analyzes Content Security Policy quality — flags unsafe-inline, unsafe-eval, and wildcard sources.
This check doesn't just verify the presence of a CSP header — it analyzes its quality. It flags dangerous directives like `unsafe-inline` (allows inline scripts, defeating most XSS protections), `unsafe-eval` (allows eval(), a common attack vector), and wildcard (`*`) sources that allow loading resources from anywhere.
A weak CSP provides a false sense of security. Having `unsafe-inline` or `unsafe-eval` in your CSP largely negates its protective value against cross-site scripting (XSS) attacks, which remain one of the most common web vulnerabilities.
A strong CSP is a critical defense against XSS attacks. Weak directives can leave your users vulnerable to script injection, data theft, and session hijacking even when a CSP header is technically present.
# Weak CSP (offers little protection):
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'
# Strong CSP:
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'; style-src 'self'; img-src 'self' data: https:; font-src 'self'Run a free audit to see how your site performs on CSP Quality Analysis and 159 other checks.
Start Free AuditVerifies the validity and configuration of the SSL certificate.
Checks if the site is secured with a valid SSL certificate.
Ensures that HTTP traffic is automatically redirected to HTTPS.
Checks for insecure (HTTP) resources on a secure (HTTPS) page.