{
"url": "https://example.com/",
"finalUrl": "https://example.com/",
"statusCode": 200,
"enforced": false,
"verdict": "no_csp",
"scriptProtection": "none",
"grade": "F",
"score": 40,
"summary": {
"errors": 1,
"warnings": 0,
"infos": 0
},
"policies": [],
"issues": [
{
"severity": "error",
"code": "csp_missing",
"message": "No Content-Security-Policy header and no <meta http-equiv=\"Content-Security-Policy\"> tag was found, so the browser applies no CSP and nothing limits where scripts load from. Basis: W3C Content Security Policy Level 3, \"Content-Security-Policy header\".",
"docs": "https://www.w3.org/TR/CSP3/#csp-header"
}
],
"metaPolicies": 0,
"cached": false,
"checkedAt": "2026-10-21T15:38:39.223Z",
"note": "Evaluates the Content Security Policy that the page declares in its HTTP response headers (Content-Security-Policy and Content-Security-Policy-Report-Only) and in <meta http-equiv> tags in the HTML head, using the W3C Content Security Policy Level 3 rules. The page is fetched with this API's own user agent, so a site that serves different headers to other clients can look different to real browsers. Policies set by scripts at runtime are not seen. Findings are static analysis of the policy text: they do not prove that a page is exploitable or safe, and a clean report is not a security guarantee."
}
curl --location --request GET 'https://zylalabs.com/api/14379/csp+evaluator+api/36041/evaluate+the+content+security+policy+of+a+website?url=https://example.com' --header 'Authorization: Bearer YOUR_API_KEY'
注册后,每个开发者都会被分配一个个人 API 访问密钥,这是一个唯一的字母和数字组合,用于访问我们的 API 端点。要使用 CSP 评估器 API 进行身份验证,只需在 Authorization 标头中包含您的 bearer token。
| 标头 | 描述 |
|---|---|
授权
|
必需
应为 Bearer access_key. 订阅后,请查看上方的"您的 API 访问密钥"。
|
找到网站内容安全策略中的弱点,这些弱点会削弱脚本注入保护。返回一个包含裁决、等级和稳定问题代码的评分 JSON 报告
网页的内容安全策略从响应头和HTML头部的元标签中读取 它返回一个裁决 一个脚本保护级别 一个等级 解析的策略和编码的问题 每个都链接到它所基于的W3C CSP 3级部分
不 这是对政策文本的静态评估 清洁报告不是安全保证 脚本在运行时添加的政策是看不见的
严格意味着脚本受到随机数或哈希的保护 允许列表意味着只有主机允许列表保护它们 无意味着没有有效的脚本保护 未知意味着无法确定 例如因为页面返回了错误状态
是的 像example.com这样的裸域被视为https 参数别名如u link target和site也被接受
是的 结果缓存15分钟 可以通过将新参数设置为1来绕过缓存 例如在您更改策略之后