CSP Checker
Content-Security-Policy presence and directive analysis.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: W3C Content Security Policy Level 3
About this validation
Content-Security-Policy presence and directive analysis.
- Protocol / standard:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live HTTP response-header fetch and directive parse performed by SEOTechTests. Standard: W3C Content Security Policy Level 3 defines the directive syntax and semantics this check parses against.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What does a Content-Security-Policy do?
It's a response header that tells the browser which sources of scripts, styles, images, and other content are allowed to load on the page, reducing the impact of a cross-site scripting (XSS) vulnerability by restricting what injected code could do.
Why does SEOTechTests check CSP directives specifically, not just header presence?
A CSP header can be present but configured so loosely (e.g. allowing 'unsafe-inline' or a wildcard source) that it provides little real protection -- this check parses the actual directive values, not just whether the header exists.
Is a missing CSP header a critical security failure?
It's a meaningful gap in defense-in-depth against XSS, but most of the web operates without CSP, so it's weighted as a lower-severity finding rather than treated the same as a confirmed malware detection.
Does having a strict CSP mean a site has no XSS vulnerabilities?
No. CSP limits what an XSS payload can do if one exists; it doesn't detect or prevent the underlying vulnerability itself.