Statically finds the weak points in a website Content Security Policy that undermine script-injection protection. Returns one graded JSON report with a verdict, script protection level, grade and coded issues, each linked to the W3C CSP Level 3 section it is based on. Offline mode checks a policy string before you deploy it.
Fetch a page once and evaluate its Content Security Policy (header and meta tag) against W3C CSP Level 3. Returns a verdict, script protection level, grade and coded issues with the specification section behind each finding. Optional fresh=1 bypasses the 15 minute cache.
Evaluate a policy string you send in (body: {"policy": "script-src 'self'", "delivery": "header", "reportOnly": false}). Offline, no outbound request, for policies you have not deployed yet.
Easiest way: the APIHub CLI. Credits cover x402, no wallet needed.
# install and set up once
npx @apihubio/cli register
npx @apihubio/cli topup 10
# call this service
npx @apihubio/cli call -X GET "https://proxy.apihub.io/csp/v1/check?url=https://example.com"Or call the proxy directly (curl / any HTTP client):
curl https://proxy.apihub.io/csp/v1/check?url=https://example.com \
-H "Authorization: Bearer ahk_your_key"
# If credits available: charged automatically, returns 200
# Otherwise: returns 402 (pay via @x402/fetch or top up credits)Estimate your monthly cost for CSP Evaluator.