Content-Security-Policy header check
Parses your CSP and flags unsafe-inline, unsafe-eval, wildcard sources, and missing directives — the hardest security header to get right.
Quick answer
Lemwatch parses every CSP directive and grades it against Mozilla's Observatory ruleset.
What it checks
- Presence of default-src / script-src
- Use of unsafe-inline, unsafe-eval (penalised)
- Wildcard sources like
* or https: (penalised)
- report-uri / report-to for violations
- frame-ancestors (replaces X-Frame-Options for modern browsers)
Where to find it in Lemwatch
Site details → Security → Headers → CSP.
How to fix
- Start in report-only mode:
Content-Security-Policy-Report-Only: ....
- Watch reports for 2 weeks, whitelist real sources.
- Replace unsafe-inline with nonces or hashes.
- Move to enforcing mode.
- Re-run the check.
FAQ
Why not just copy a "strict CSP" from a template?
Every site loads different third parties — a copy-paste CSP usually breaks analytics or fonts.
Does CSP block third-party ads?
Only the sources you don't whitelist.
Related