Content-Security-Policy (CSP) checker
A Content-Security-Policy tells the browser which scripts, styles and sources are allowed to load, so an injected script cannot just run. This free checker tells you whether your live site sets one, and whether it actually restricts scripts.
Run the check
What this checks
It reads your site's response headers, and a policy set by meta tag, and reports whether a Content-Security-Policy is present and whether it governs scripts. A policy with no script-src or default-src, one that allows 'unsafe-inline' without a nonce or hash, or one that allows scripts from any host is reported as not protecting you, with the reason. A missing or toothless CSP is the single biggest gap in browser-side defense against cross-site scripting, because without one that works, any script that gets onto your page runs with full access.
Why it gets missed
CSP is fiddly to write, so AI tools skip it and the app still works. The cost only shows up when someone finds a way to inject a script and there is nothing stopping it. Adding even a starter policy is a large improvement over none, as long as it restricts scripts: in two AI-built apps we audited by hand in October 2026, the CSP was there and stopped nothing, because one set only frame-ancestors and the other allowed 'unsafe-inline'.
See the full step-by-step fix, with a copy-paste block for your AI tool →