Security Tools
Content Security Policy (CSP) Checker
Check whether a website sends a Content-Security-Policy header.
Enter a domain to check whether it sends a Content-Security-Policy header.
JustChecker monitors your security headers continuously and alerts you if any regress.
Frequently Asked Questions
CSP primarily mitigates cross-site scripting (XSS) by restricting which sources of scripts, styles, and other resources the browser is allowed to load and execute - even if an attacker manages to inject malicious code, a strict CSP can prevent it from actually running.
Unlike a simple presence/absence header, CSP requires an accurate, maintained list of every legitimate script/style/resource source your site actually uses - too strict breaks functionality, too loose provides little real protection.
It allows inline scripts/styles directly embedded in HTML to execute, which significantly weakens CSP's core XSS protection, since that's exactly the injection vector CSP is primarily designed to block.
Yes - the Content-Security-Policy-Report-Only header lets you monitor what WOULD be blocked without actually enforcing it, letting you refine the policy safely before switching to full enforcement.
It means you're missing one specific, valuable layer of defense-in-depth against XSS - other protections (input sanitization, output encoding in your application code) still matter and function independently of CSP.
Adding any new third-party script, font, analytics tool, or embedded widget typically requires updating your CSP to explicitly allow that new source - it's an ongoing maintenance commitment, not a set-once configuration.