Content-Security-Policy (CSP) checker
A Content-Security-Policy tells the browser which scripts, styles and sources are allowed to load, so an injected script cannot just run. This free checker tells you whether your live site sets one.
Run the check
What this checks
It reads your site's response headers and reports whether a Content-Security-Policy is present. A missing CSP is the single biggest gap in browser-side defense against cross-site scripting, because without it any script that gets onto your page runs with full access.
Why it gets missed
CSP is fiddly to write, so AI tools skip it and the app still works. The cost only shows up when someone finds a way to inject a script and there is nothing stopping it. Adding even a starter policy is a large improvement over none.
See the full step-by-step fix, with a copy-paste block for your AI tool →