CSP Checker

Monitor Content Security Policy headers, catch risky directives, and keep a history of scheduled scans.

Add Site

Ring fail Score 30/100
https://ringcontainer.com
Last Scan 1 month ago
Next Scan 1 month ago
HTTP 200

Policy

default-src 'self'; script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' https://cdn-cookieyes.com https://js.hs-banner.com https://js.hs-analytics.net https://js.hscollectedforms.net https://js.hs-scripts.com https://player.vimeo.com https://www.googletagmanager.com/gtm.js https://www.googletagmanager.com/gtag/js https://googleads.g.doubleclick.net https://www.googleadservices.com https://analytics.google.com https://use.typekit.net https://cdn.rawgit.com https://code.jquery.com https://p.typekit.net https://cdn.jsdelivr.net https://assets.squarespace.com https://kit.fontawesome.com; style-src 'report-sample' 'unsafe-inline' 'self' https://use.typekit.net https://cdn.rawgit.com https://p.typekit.net https://cdn.jsdelivr.net https://assets.squarespace.com;   base-uri 'self'; connect-src 'self' https://cdn-cookieyes.com https://log.cookieyes.com https://pagead2.googlesyndication.com https://www.google-analytics.com https://sourcemaps.squarespace.net https://forms.hscollectedforms.net https://googleads.g.doubleclick.net https://www.googleadservices.com https://ka-p.fontawesome.com https://use.typekit.net https://cdn.rawgit.com https://p.typekit.net https://www.google.com https://analytics.google.com https://performance.squarespace.com; font-src 'self' data: https://ka-p.fontawesome.com https://use.typekit.net https://cdn.rawgit.com https://p.typekit.net https://assets.squarespace.com 'self' 'unsafe-inline';   frame-src 'self' https://www.google.com/ https://player.vimeo.com https://www.googletagmanager.com/ https://td.doubleclick.net/;  img-src 'self' 'unsafe-inline' https://cdn-cookieyes.com https://www.googletagmanager.com https://pagead2.googlesyndication.com https://track.hubspot.com https://forms.hsforms.com https://googleads.g.doubleclick.net https://www.google.com;

Findings

high script-src allows inline code with 'unsafe-inline'. script-src 'unsafe-inline'

Prefer nonces or hashes for inline scripts and styles.

high script-src allows dynamic code execution with 'unsafe-eval'. script-src 'unsafe-eval'

Remove eval-style JavaScript or isolate the dependency that requires it.

medium The policy does not limit which sites can frame this page. frame-ancestors

Add frame-ancestors 'none' or an explicit allowlist to reduce clickjacking risk.

medium The policy does not set object-src to 'none'. object-src

Add object-src 'none' unless legacy plugins are intentionally required.

medium style-src allows inline code with 'unsafe-inline'. style-src 'unsafe-inline'

Prefer nonces or hashes for inline scripts and styles.