Security headers checker
Check the Content-Security-Policy and security headers of any page.
Questions
What do security headers do?
They are HTTP response headers that tell the browser what a page may do: where scripts can load from, whether other sites can put it in a frame, and whether to always use HTTPS. They protect visitors from attacks like cross-site scripting and clickjacking.
What is a good first Content-Security-Policy?
Start with default-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none' and add the hosts your page loads from. Send it as Content-Security-Policy-Report-Only first, check the browser console for blocked requests, then switch to Content-Security-Policy.
Why is 'unsafe-inline' a problem?
It lets every inline script run, including one an attacker injects. Give the inline scripts you need a nonce or a hash instead. When a nonce or a hash is in script-src, browsers ignore 'unsafe-inline'.
Does a Content-Security-Policy in a meta tag work?
Most of it does. Browsers ignore frame-ancestors, report-uri and sandbox in a meta tag, so send those in the header.
Are the links I check saved?
No. The page is fetched when you press Check, and nothing is stored.
How it works
The page at the link is fetched from our server, once at its address and once over http:// to see if it redirects to HTTPS. The checks read the response headers and any Content-Security-Policy in a <meta> tag. When both are set, the browser applies both, so the checks read them together.
The checks cover the headers most sites need. A page can pass all of them and still have other security problems.
Company of Craft also builds 
stateofpixel, which catches UI regressions before they merge.