Check a site's security headers
HSTS, CSP, framing, sniffing and CORS in one request — with a Content-Security-Policy analysis that understands nonces, so it does not report the false positives other scanners do.
Why most CSP checkers are wrong
A policy containing 'unsafe-inline' is usually reported as a critical failure.
That is correct — unless a nonce or hash is also present, in which case browsers
ignore 'unsafe-inline' entirely and the policy is doing its job.
Reporting that as a vulnerability is a false positive, and it is why teams learn to distrust
header scanners.
The mirror mistake: a policy with 'strict-dynamic' and a long, carefully curated
list of CDN hosts. Browsers ignore the host list. The policy is fine — but the effort spent
maintaining that list is wasted, and no scanner tells you so.
This one gets both right. How that works →
What we found scanning 188 well-known sites
On 2026-08-04, of 188 sites that responded:
| Publish an enforcing CSP | 108 of 188 |
| …of those, use a nonce or hash rather than an allowlist | 30 |
| Grade A | 17 |
| Grade D or F | 114 |