Quick test
Run this in your terminal:
curl -I https://yoursite.com | grep -i "content-security-policy"
What you want to see
content-security-policy: default-src 'self'; ...
What you do not want to see
Nothing at all
This means you have no CSP. Any script can run on your site.
Ready to apply the FORGE framework?
VibeSec Advisory helps knowledge worker teams redesign real processes using the six FORGE pillars: Baseline, Skills, Agents, Guardrails, Schedule, and Capture. The next step is advisory intake, not checkout.
unsafe-inline
This weakens your CSP. Attackers can inject inline scripts.
unsafe-eval
This allows eval() calls. Rarely needed and dangerous.
Asterisks
script-src * means scripts from anywhere. Not great.
The ideal CSP
Content-Security-Policy:
default-src 'self';
script-src 'self';
style-src 'self';
img-src 'self' data:;
font-src 'self';
connect-src 'self';
frame-ancestors 'none';
base-uri 'self';
form-action 'self';
Start strict. Relax only what you need.
Why bother
CSP stops XSS attacks. Even if an attacker injects a script, the browser will not run it.
It is your last line of defense.
If your CSP check failed, we can help. Book a FORGE session