Security Headers Checker

We loaded your site in a real headless Chrome browser to capture every script and connection it actually makes — including Cloudflare-injected scripts and dynamic fetch() calls that a simple HTML scan misses. This screenshot is what the browser saw.

We looked at the outside services your homepage loads (fonts, analytics, embeds) and built a ready-to-paste policy. It is a safe starting point designed not to break your site. Important: we can only see what loads on the first page view. Scripts that load after a cookie-consent banner is accepted (live chat like Freshdesk or Intercom, analytics, ad pixels) won’t appear here. To catch those, deploy this as Content-Security-Policy-Report-Only first — it blocks nothing, just reports what would be blocked. Browse your own site, accept the cookie banner, open the chat widget, then add any missing domains before switching to the enforcing Content-Security-Policy header.

How to read the violations: open your browser’s DevTools (press F12, or right-click → Inspect) and click the Console tab. With Report-Only active, every blocked resource prints a line like “[Report Only] Refused to load the script ‘https://widget.freshworks.com/…’ because it violates the following Content Security Policy directive: script-src …” — the URL in that message is the domain you need to add. Reload the page, accept cookies, open each widget, and collect every domain the console flags.

⚠ Note: This tool cannot detect resources that a cookie-consent banner blocks until the visitor accepts. You must verify in your own browser’s console (above), then use your AI tool to add the new domains to the policy we generated for you.

These optional headers were detected on your site. Most websites do not need them, but if one is set to an outdated or risky value it is flagged below.