web / security / CSP
CSP policy review guide
Review boundaries for default-src, nonces, objects, frames, inline code and Report-Only with synthetic cases. No network or execution occurs.
Policy boundaries
Keep enforcement directives distinct from the observation-only Report-Only mode.
| Case | Result | Key point |
|---|---|---|
| Choose a case to show the matrix. | ||
Why no real policy is handled
This page performs no URL fetch, upload, external request, storage, parsing or script execution.
Synthetic results do not certify a real site's CSP. Confirm delivered headers and actual resources separately.