Free tool
Would your headers stop the common web attacks?
We read your page's response headers and grade each one, then build a starting Content-Security-Policy from the scripts, styles, images and frames your page really loads.
Why it matters
Headers are the cheapest security you will ever ship
A handful of response headers tell browsers to refuse plain http, to keep your pages out of other sites' frames, and to run only the scripts you name. They cost nothing per request and take minutes to add.
Roll out safely
Report first, then enforce
Start the policy as Content-Security-Policy-Report-Only for a week. The browser reports what it would have blocked without blocking it, so you can add the sources you missed before you switch it on.
Want it fixed?
Get a policy that does not break checkout
A cloud security review covers headers, identity, exposure and logging across your whole cloud, with a fixed list of changes in priority order.