headers
1 post · all writing
Your CSP is strong and broken, and no scanner will tell you
Every header tool grades a Content-Security-Policy on strength. None of them checks whether it works. A policy that blocks your own scripts scores well and breaks the site, which is why so many teams ship a strong CSP in report-only mode forever, or a weak one that scores badly and works.