Weak CSP Scanner
Detects unsafe directives like 'unsafe-inline' or 'unsafe-eval' that weaken your CSP's XSS protection.
What it checks
This scanner analyzes your Content-Security-Policy for unsafe directives like unsafe-inline or unsafe-eval. These options loosen the policy so much that it stops protecting you effectively. The scanner only reviews how the CSP is defined, it does not rewrite it.
Why it matters
A CSP with these directives barely stops the script injection (XSS) attacks it is meant to block. It gives a false sense of security: it looks like you are protected, but the protection is hollow. An attacker who injects code can run it without trouble.
How to fix it
Remove unsafe-inline and unsafe-eval from your policy and replace them with a nonce- or hash-based approach for the scripts you genuinely need. Start from a strict policy and allow only what is essential. Test changes carefully, since a poorly tuned CSP can break legitimate functionality.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free