What does your site actually load?
Enter a domain. EnforceCSP crawls its public pages in a headless browser, records every resource each page requests, and shows you the Content-Security-Policy those requests would need — and where your current policy already falls short.
A scan crawls up to 100 real pages, so it needs an account · reports stay private until you share them · already have one?
# built only from what the browser was observed requesting
default-src 'self';
script-src 'self' https://cdn.example.com https://js.stripe.com;
style-src 'self' https://fonts.googleapis.com;
font-src 'self' https://fonts.gstatic.com;
img-src 'self' data:;
connect-src 'self' https://api.example.com;HTML parsing lies. Browsers don't.
Modern applications inject most of their resources with JavaScript, so anything that only reads markup misses them. Every page is loaded in a real Chromium instance and every network request it makes is recorded.
-
1
Crawl
Starts at your homepage, follows internal links and the sitemap, and respects robots.txt. Subdomains are treated as separate sites.
-
2
Observe
Each page is loaded in headless Chromium. Scripts, styles, images, fonts, XHR, WebSockets and frames are all captured from the network layer.
-
3
Normalize
Every request is reduced to an origin and mapped onto the CSP directive that governs it.
-
4
Report
You get the origins grouped, the policy you have today, and the policy your traffic actually needs.
Every origin, grouped
Not thousands of URLs — the handful of origins that matter, with the resource types seen on each and how many pages loaded from them.
| Origin | Types | Pages |
|---|---|---|
| cdn.example.com | JS CSS | 23 |
| js.stripe.com | JS Frame | 4 |
| fonts.gstatic.com | Font | 12 |
| api.example.com | Fetch | 18 |
Potential mismatches
Already have a CSP? Every observed origin is checked against it, and anything the written policy doesn't appear to list is flagged.
script-src → https://js.stripe.com
not listed in current policy
Inline & eval detection
Inline scripts, inline styles and eval() are reported so you can plan nonces or hashes. They never silently become 'unsafe-inline'.
What this is
- A discovery tool for the resources your public pages load
- A deterministic transformation: observed requests to CSP directives
- A starting point you test in report-only mode
What this is not
- A vulnerability scanner or penetration-testing tool
- A violation-report collector — nothing here proves a browser blocked a request
- A guarantee: pages behind a login or user interaction are not observed
Outbound requests are checked before they are made: private, loopback, link-local and reserved addresses are refused, and every redirect hop is re-checked.