Verificador de CSP Grátis

Analise as diretivas do seu Content-Security-Policy e descubra os riscos. Seus dados nunca saem deste navegador.

CONTENT-SECURITY-POLICY1 lines

default-src'self'

script-src'self' https://cdn.example.com 'unsafe-inline'

img-src*

style-src'self'

upgrade-insecure-requests(flag)

risco'unsafe-inline' in script-src

Inline code is allowed, which enables XSS. Prefer nonces or hashes.

avisoWildcard source in img-src

* allows any origin. Restrict to specific trusted hosts.

avisoMissing object-src

Set object-src 'none' to block plugins like Flash.

avisoMissing base-uri

Set base-uri 'none' to prevent base-tag hijacking.

avisoMissing frame-ancestors

Set frame-ancestors 'none' or 'self' to prevent clickjacking.

corretoupgrade-insecure-requests enabled

HTTP subresources are upgraded to HTTPS.

Pronto