CSP header checker

This check reads the Content-Security-Policy header text and flags what the text alone can prove: missing default-src, unsafe-inline and unsafe-eval, bare wildcards and scheme sources, missing object-src, base-uri, and frame-ancestors, and a policy with nowhere to report violations. It cannot see whether the page's actual scripts and styles would pass the policy, and a Report-Only header is measured but not enforced by the browser. To grade a policy you paste by hand, use the CSP evaluator instead.