Content Security Policy
Controls where browser content may load from and can reduce the impact of some injection flaws.
Enter a URL and review the security-related response headers observed by the checker. The results highlight protections that appear present, missing, or worth a closer look.
This is an illustration and evidence-collection tool, not an automated vulnerability verdict. Every result still needs to be verified in the context of the application.
The checker follows a small number of HTTPS redirects, reviews the final response, and evaluates six common browser security headers. Private and local network destinations are blocked.
A missing header is not automatically a vulnerability, and a present header is not automatically effective. The checker is designed to help start the review, not end it.
Controls where browser content may load from and can reduce the impact of some injection flaws.
Checks CSP frame-ancestors and X-Frame-Options for protection against unwanted framing.
Checks whether the browser is instructed to continue using HTTPS for future connections.
Checks for X-Content-Type-Options: nosniff to reduce content-type interpretation surprises.
Reviews whether the application explicitly controls what URL information may be sent during navigation.
Checks whether browser capabilities such as camera, microphone, and geolocation are explicitly constrained.
Use the linked explainers and tools to understand the behavior, then verify it manually in the context of the application before it becomes a finding.