Security & SEO

    Content-Security-Policy header check

    Parses your CSP and flags unsafe-inline, unsafe-eval, wildcard sources, and missing directives — the hardest security header to get right.

    Updated 2026-07-10
    1 min read
    csp
    security-headers
    xss

    Quick answer#

    Lemwatch parses every CSP directive and grades it against Mozilla's Observatory ruleset.

    What it checks#

  1. Presence of default-src / script-src
  2. Use of unsafe-inline, unsafe-eval (penalised)
  3. Wildcard sources like * or https: (penalised)
  4. report-uri / report-to for violations
  5. frame-ancestors (replaces X-Frame-Options for modern browsers)

    6. Where to find it in Lemwatch#

    Site details → Security → Headers → CSP.

    How to fix#

  6. Start in report-only mode: Content-Security-Policy-Report-Only: ....
  7. Watch reports for 2 weeks, whitelist real sources.
  8. Replace unsafe-inline with nonces or hashes.
  9. Move to enforcing mode.
  10. Re-run the check.

    11. FAQ#

    Why not just copy a "strict CSP" from a template?#

    Every site loads different third parties — a copy-paste CSP usually breaks analytics or fonts.

    Does CSP block third-party ads?#

    Only the sources you don't whitelist.

    Related#

  11. Security headers
  12. HSTS header check
  13. X-Frame-Options check
    14. Was this article helpful?

    Previous

    HSTS header check

    Next

    X-Frame-Options / frame-ancestors check

    Related Articles

    Security Headers Explained

    What security headers are, why they matter, and how to fix them.

    HSTS header check

    Verifies Strict-Transport-Security is present, has max-age ≥1 year, and includes subdomains — the single biggest SSL grade lift.

    X-Frame-Options / frame-ancestors check

    Confirms clickjacking protection is enabled via X-Frame-Options or the modern CSP frame-ancestors directive.

    Canonical tag check

    Crawls your top pages and flags missing, self-referential loops, cross-domain, or conflicting canonical tags — the top-3 SEO indexation bug.

    Back to Help Center