HTTP headers
Content-Security-Policy validator
Analyze your CSP and find out if it protects against XSS.
Free, non-invasive check in seconds. No signup.
Scan my website for freeCSP tells the browser which origins may load scripts, styles and images.
Why it matters
Without CSP, a single XSS flaw can run malicious code in your users' browsers.
How to fix
Start with default-src 'self' and allow only the domains you use.
FAQ
- Can CSP break my site?
- Yes if too strict — test with Report-Only first.
Other free tools
- Free security headers checker
- HSTS checker
- SSL / HTTPS checker
- DMARC, SPF and DKIM checker
- Exposed .env and .git checker
- WordPress security scanner
- Free website security test
- Is this website safe? Free checker
- Is this website legit or a scam?
- Fake online store checker
- Phishing link checker
- Check if a link is safe to open
- Free website vulnerability scanner
- SaaS security checklist for founders
- Website clone checker
- YouTube & TikTok scam video checker
- Security trust badge for your website
- Fake website checker
- Suspicious link checker
- How to check a domain's age
- Where does a short link go?
- Is this video a scam?
- Celebrity deepfake scam videos
- Betting signal bots and VIP groups
- How to report a scam video
- How to find cloned websites of your brand
- Free typosquatting domain checker
- How to take down a fake website
- Brand protection and domain monitoring
- Homograph domain attack checker
- How to report a phishing domain to Google