---
title: "Content-Security-Policy header check — Lemwatch Help"
description: "Parses your CSP and flags unsafe-inline, unsafe-eval, wildcard sources, and missing directives — the hardest security header to get right."
canonical: "https://lemwatch.com/help/csp-header-check"
source: "https://lemwatch.com"
---

# Content-Security-Policy header check

> Parses your CSP and flags unsafe-inline, unsafe-eval, wildcard sources, and missing directives — the hardest security header to get right.

## Quick answer

 Lemwatch parses every CSP directive and grades it against Mozilla's Observatory ruleset.

## What it checks

- Presence of default-src / script-src

- Use of unsafe-inline, unsafe-eval (penalised)

- Wildcard sources like * or https: (penalised)

- report-uri / report-to for violations

- frame-ancestors (replaces X-Frame-Options for modern browsers)

## Where to find it in Lemwatch

 **Site details → Security → Headers → CSP.**

## How to fix

- Start in report-only mode: Content-Security-Policy-Report-Only: ... .

- Watch reports for 2 weeks, whitelist real sources.

- Replace unsafe-inline with nonces or hashes.

- Move to enforcing mode.

- Re-run the check.

## FAQ

### Why not just copy a "strict CSP" from a template?

 Every site loads different third parties — a copy-paste CSP usually breaks analytics or fonts.

### Does CSP block third-party ads?

 Only the sources you don't whitelist.

## Related

- Security headers

- HSTS header check

- X-Frame-Options check


## Related

- [Help centre](https://lemwatch.com/help)
- [Security Headers Explained](https://lemwatch.com/help/security-headers)
- [HSTS header check](https://lemwatch.com/help/hsts-header-check)
- [X-Frame-Options / frame-ancestors check](https://lemwatch.com/help/x-frame-options-check)
- [Cookie security check](https://lemwatch.com/help/cookie-security-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [Monitor a single element with CSS selectors](https://lemwatch.com/help/css-selector-monitoring)
- [Creating PDF Reports](https://lemwatch.com/help/creating-pdf-reports)