CSP チェッカー 無料
CSPのディレクティブを解析して、潜むリスクを洗い出す。 データがこのブラウザの外に出ることはありません。
CONTENT-SECURITY-POLICY1 lines
default-src'self'
script-src'self' https://cdn.example.com 'unsafe-inline'
img-src*
style-src'self'
upgrade-insecure-requests(flag)
リスク'unsafe-inline' in script-src
Inline code is allowed, which enables XSS. Prefer nonces or hashes.
警告Wildcard source in img-src
* allows any origin. Restrict to specific trusted hosts.
警告Missing object-src
Set object-src 'none' to block plugins like Flash.
警告Missing base-uri
Set base-uri 'none' to prevent base-tag hijacking.
警告Missing frame-ancestors
Set frame-ancestors 'none' or 'self' to prevent clickjacking.
良好upgrade-insecure-requests enabled
HTTP subresources are upgraded to HTTPS.
準備完了