What is Content-Security-Policy?

Content-Security-Policy (CSP) tells browsers which sources are allowed for scripts, styles, images, frames, and other resources. A careful CSP reduces the impact of injected script by limiting where code can load from.

What HeaderGrade checks

• Whether a Content-Security-Policy response header is present
• Whether default-src or script-src appears
• Whether unsafe-inline / unsafe-eval weaken the policy

Example (starting point only)

Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; base-uri 'self'

Real apps often need CDN hosts, inline styles with nonces, or report-only mode while you iterate. A broken CSP can blank your UI — test carefully.

Grade a URL