Paste a Content-Security-Policy header — get an instant grade, sub-scores, severity-ranked findings, fix examples, and compliance mapping (PCI DSS / OWASP ASVS / NIST / SOC 2).
Overall A–F grade and 0–100 score, broken down into Security, Compliance, and Best Practices sub-scores. Every deduction is itemized — no black-box numbers.
Critical security flaws, known CSP bypass hosts, modern best practices (Trusted Types, strict-dynamic, nonce strength), reporting setup, smell tests (typos, unquoted keywords, duplicate directives), and browser compatibility warnings.
Every finding cites the relevant W3C, OWASP, MDN, or compliance section — and ships a before/after fix example you can paste into your config.
Maps your policy against PCI DSS 4.0, OWASP ASVS V14.4, NIST 800-53 rev5, and SOC 2 controls — so you know exactly which boxes you've ticked and which ones you haven't. No other free tool does this.
ProxiedGuardians generates and enforces your CSP at the edge — no code changes required. Start free on one domain.