Header Security

Content-Security-Policy Header Check

Learn how to configure the CSP header to prevent malicious script execution and XSS attacks. A practical guide with policy examples tailored to your site.

What this test checks

This test checks for the presence and configuration of the Content-Security-Policy (CSP) header. It allows you to define allowed content sources (scripts, images, styles), thereby preventing unauthorised script execution (XSS) and malicious content injections.

Our recommendation

Add the CSP header with a strict policy, e.g.: 'default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline';'. Avoid using 'unsafe-inline' and 'unsafe-eval' if possible. Use 'report-only' mode to test changes before applying them in production.

Security tests

View all tests

Header Security

Content-Security-Policy Header Check

What this test checks

Our recommendation

Read more

Cross-Origin-Opener-Policy Header Check

Shopify SSL/TLS Configuration Check

Upload Folder Indexing Check

CAPTCHA Presence on Contact Form Check

WordPress REST API Access Check

SSL Certificate Check

Joomla Version Check

Drupal settings.php File Access Check

Drupal Log File Exposure Check

Magento Session Cookie Security Check

Cross-Origin-Resource-Policy Header Check

Malicious File Presence Check in Upload Folders

PHP Error Display on Drupal Check

Configuration File Exposure Check

Shopify HSTS Header Check

Shopify CSRF Protection Check

HttpOnly Flag on Joomla Session Cookies Check

Known CVE Vulnerability Check on Used Technologies

Shopify Admin CAPTCHA Protection Check

Shopify File Upload Security Check

X-Content-Type-Options: nosniff Header Check

CAPTCHA Presence on Client Login Page Check

SQL Query Exposure Check

Shopify Registration CAPTCHA Protection Check

PHP Error Display on WordPress Check

xmlrpc.php Access Check

Shopify SQL Injection Protection Check

Magento env.php File Access Check

Magento Backup File Exposure Check

Drupal Upload Folder Indexing Check (sites/default/files/)

X-Frame-Options Header Check

Shopify Log File Exposure Check

PrestaShop Admin Login Page Protection Check

CAPTCHA Presence on Admin Page Check

Shopify Sensitive File Exposure Check

CAPTCHA Presence on Password Reset Form Check

Shopify Cookie Consent Banner Presence Check

CAPTCHA Presence on Public Forms Check

Joomla REST API Access Check

Shopify Upload Folder Security Check

Shopify Permissions-Policy Header Check

Shopify Terms and Conditions (T&C) Presence Check

Drupal Admin Login Page Protection Check

Shopify Client Login CAPTCHA Protection Check

Login Attempt Limiting Check

CNIL Mention in Privacy Policy Check

Development File Exposure Check

Two-Factor Authentication (2FA) Check

PrestaShop Upload Folder Indexing Check

Drupal Admin Access Restriction Check

Magento Version Check

Shopify REST API Exposure Check

Email Address Exposure Check

WordPress Debug Log Exposure Check

Shopify Password Reset CAPTCHA Protection Check

Shopify Environment Information Exposure Check

PrestaShop Backup File Exposure Check

Shopify Password Protection Check

Shopify Cart Endpoint Exposure Check

Server Status Pages Access Check

PrestaShop Session Cookie Security Check

Shopify Contact Form CAPTCHA Protection Check

Database Administration Tools Access Check

Joomla Admin Login Page Protection Check

PHP Error Display in Production Check

Joomla Backup File Exposure Check

PrestaShop Version Check

Referrer-Policy Header Check

Shopify Storefront API Exposure Check

Upload Folder Protection Check (.htaccess, index.html files)

Joomla Log File Exposure Check

Shopify Error Display Check

PrestaShop Admin Access Restriction Check

wp-config.php File Access Check

Cookie Security Check

Shopify HTTPS Redirect Check