Csp Evaluator

unsafe-inline defeats the purpose

A policy permitting 'unsafe-inline' for scripts allows exactly the injection CSP exists to block. It is the most common weakness by a wide margin, added during rollout to stop things breaking and never removed. A policy containing it provides negligible XSS protection regardless of how restrictive the rest looks.

Nonces and strict-dynamic are the working approach

Give each legitimate inline script a per-request nonce, or a hash of its content. 'strict-dynamic' then extends trust to scripts those load, which is what makes CSP workable on sites with tag managers and third-party loaders — without it, every transitively loaded script needs its own allowlist entry and the policy becomes unmaintainable.

Wildcards and CDN allowlists leak

Allowing a whole CDN is close to allowing anything, because most large CDNs host libraries with known JSONP endpoints or Angular versions that permit arbitrary execution. An allowlist containing a general-purpose CDN is frequently bypassable, which is the argument for nonce-based policies over host allowlists.

object-src and base-uri are routinely forgotten

object-src 'none' blocks plugin-based execution. base-uri 'none' prevents an injected base tag redirecting every relative script URL to an attacker's host — a bypass that works against otherwise strict policies. Both are cheap and both are commonly missing.

Report-only first

Deploy with Content-Security-Policy-Report-Only and a reporting endpoint for a few weeks. Every non-trivial site discovers dependencies its authors had forgotten, and enforcing an untested policy typically breaks analytics, embedded video and payment widgets simultaneously.