default-src
Provides a fallback source list for many resource types when a more specific directive is absent.
default-src 'self'
DeployPass / Security Headers Checker / CSP Checker
Free · No signup · Passive public checkFree CSP Checker
Check the Content-Security-Policy header on any public website. Review risky directives, unsafe sources, framing controls and common CSP configuration issues in seconds.
DeployPass reads the public response header only. It does not execute attacks or prove an application is secure.
Checking Content-Security-Policy…
CSP SCORE
—/100
REVIEWContent-Security-Policy review
—Header
—Directives
—Warnings
—Framing control
Content-Security-Policy: —
Understand the result
What a useful CSP policy controls.
Content Security Policy tells browsers which sources may load scripts, styles, images, frames and other resources. DeployPass highlights high-signal public configuration choices rather than treating every policy difference as a vulnerability.
script-src
Controls JavaScript sources. Broad wildcards, unsafe-inline and unsafe-eval can weaken the protection CSP provides.
script-src 'self' https://cdn.example.com
object-src
Restricts plugin content. Many modern policies disable it entirely when plugins are not needed.
object-src 'none'
frame-ancestors
Controls which sites may embed the page in a frame and is a modern CSP defense against unwanted framing.
frame-ancestors 'none'
base-uri
Restricts the URLs that can be used by the HTML base element and can reduce base-tag injection risk.
base-uri 'self'
form-action
Restricts where forms may submit. It can reduce the impact of injected or modified form destinations.
form-action 'self'
Important
Do not optimize CSP for a perfect score.
A CSP must match the application it protects. Removing a source or adding a strict directive without testing can break legitimate scripts, styles, frames or forms. Use the findings as review points, then test changes in the real application. Report-Only can help during staged rollouts.
FAQ
CSP checker FAQ
What is a Content Security Policy?
CSP is an HTTP response header that lets a site declare which sources browsers may use for scripts, styles, images, frames and other resource types.
Is unsafe-inline always a vulnerability?
No. It weakens an important CSP protection, but the real risk depends on the policy, use of nonces or hashes, browser behavior and the application. DeployPass flags it for review rather than claiming exploitation.
What is the difference between CSP and CSP Report-Only?
Content-Security-Policy is enforced by the browser. Content-Security-Policy-Report-Only can observe policy violations without enforcing the policy, which is useful while testing changes.
Should object-src be set to none?
For applications that do not need plugin content, object-src 'none' is a common restrictive choice. Confirm compatibility before changing a production policy.
Can I check all security headers?
Yes. DeployPass also provides a Security Headers Checker, an HSTS Checker and the full 19-check public deployment scan.