The Standard for Edge Policy Optimization
Wildcard Bundling
Large CSP headers can bloat your HTTP response, negatively impacting Time to First Byte (TTFB). The engine detects redundant domains (e.g., api.app.com, cdn.app.com) and recommends safe wildcard bundling like *.app.com to compress header size without compromising zero-trust boundaries.
Server-Aware Baselines
If an upstream server returns no Content-Security-Policy or Content-Security-Policy-Report-Only header, the tool analyzes your Server and X-Powered-By headers to generate a custom, strict baseline policy specifically architected for your tech stack.
Frequently Asked Questions
What is a Content Security Policy (CSP) and why does every website need one?
A Content Security Policy is an HTTP response header that instructs the browser to only load resources — scripts, styles, images, fonts, frames — from explicitly approved sources. Without a CSP, a successful Cross-Site Scripting (XSS) attack can inject and execute arbitrary JavaScript in a visitor's browser, stealing session cookies, redirecting users to phishing pages, or silently exfiltrating form data. CSP is the last line of browser-enforced defense after your application code has been compromised. Since 2023, Google's Lighthouse security audit flags missing CSP headers, and major compliance frameworks including PCI-DSS v4.0 and SOC 2 now require documented script execution controls — which CSP directly satisfies.
What is a CSP score and how is it calculated?
This tool calculates a deterministic security score from 1 to 100 based on ten 2026 compliance checks. Each check carries a weighted deduction if failed: missing unsafe-inline protection in script directives deducts 30 points (the highest penalty, as it fully negates XSS protection); missing object-src 'none' deducts 20 points; missing frame-ancestors deducts 15 points; missing base-uri restriction deducts 10 points; missing unsafe-eval protection deducts 10 points; absent nonces or strict-dynamic deducts 8 points; missing upgrade-insecure-requests deducts 5 points; unrestricted form-action deducts 5 points; absent require-trusted-types-for deducts 5 points; and missing violation reporting deducts 2 points. Scores of 90–100 are green, 70–89 yellow, 50–69 orange, and below 50 red.
What is the difference between script-src 'unsafe-inline' and style-src 'unsafe-inline'?
script-src 'unsafe-inline' permits inline <script> tags and JavaScript event handlers like onclick="" to execute — this is a critical XSS vulnerability because an attacker who injects any HTML into your page can immediately run JavaScript. style-src 'unsafe-inline' permits inline <style> tags and style="" attributes — this enables CSS injection attacks (used for data exfiltration via attribute selectors) but does not directly allow JavaScript execution. This tool's compliance engine evaluates them independently.
Why is unsafe-inline in script-src flagged as a severe vulnerability?
The 'unsafe-inline' keyword in script-src or default-src permits any inline <script> block, inline event handler (onload, onclick, onerror), and javascript: URI to execute in the browser. This single directive completely disables the XSS protection that CSP provides. The correct replacement is cryptographic nonces ('nonce-abc123') generated fresh on every server response, or SHA hashes ('sha256-...') of specific trusted inline blocks.
What is strict-dynamic and when should I use it?
'strict-dynamic' in script-src allows a trusted nonce-validated script to dynamically load additional scripts at runtime without those child scripts needing to be individually whitelisted. This is essential for modern JavaScript bundlers, tag managers, and single-page application frameworks that load modules programmatically. Note that strict-dynamic ignores 'unsafe-inline' and host allowlists in supporting browsers (Chrome 52+, Firefox 52+, Safari 15.4+).