SecurityUsually medium

Content-Security-Policy checker: does your site send a CSP header?

A Content-Security-Policy tells the browser which scripts and resources your page is allowed to load. It's the main defence against cross-site scripting. ShipPatrol checks your response headers for one.

Why it matters

Without a CSP, any script that gets into your page, through a vulnerable library, a compromised third-party tag or a stored comment, runs with full access to your visitors' sessions. A CSP limits the damage.

How Patch checks

We read the headers your homepage returns and look for Content-Security-Policy (a report-only policy doesn't count, because it doesn't block anything).

How to fix it

Start with a policy in report-only mode listing the domains your site really uses.
A starting point: default-src 'self'; script-src 'self' <those domains>; frame-ancestors 'self'; object-src 'none'; base-uri 'self'.
Watch the reports for a week, adjust, then switch to the enforcing Content-Security-Policy header in your host config.

Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.

Where this applies

Good security practice everywhere.

Free scan

Check this on your site.

Patch runs "No Content-Security-Policy header" along with every other check, from the UK, the EU and the US. Free, no signup.