CSP & HSTS Preload Analyzer
Break down a site's Content-Security-Policy directive by directive and flag the weak spots, then check whether its Strict-Transport-Security header meets every requirement for the browser HSTS preload list.
FAQ
What makes a CSP weak?
Allowing 'unsafe-inline' or 'unsafe-eval', wildcard sources, or omitting default-src, object-src and base-uri all let injected content run or load.
What are the HSTS preload requirements?
Serve HTTPS, send Strict-Transport-Security with max-age of at least a year, and include both includeSubDomains and preload.
Is report-only CSP enough?
No. Report-only just monitors. Move the tuned policy to the enforcing Content-Security-Policy header so it blocks.
Does HSTS preload have downsides?
Yes - removal from the list is slow. Only add preload once every subdomain reliably serves HTTPS.
CSP and HSTS in short
Content-Security-Policy controls where a page may load scripts, styles and other resources from - a strong policy blocks injected code. HSTS forces browsers to use HTTPS, and the preload list ships that rule inside the browser so even the first visit is protected.
For the full A-F picture of every security header, use the Security Headers checker.