Script execution policy
Broad wildcards, unsafe-eval and unrestricted inline script execution deserve review because CSP is strongest when executable sources are narrowly controlled.
Website security
Inspect the site Content Security Policy.
Read the enforcing CSP and highlight broad script execution allowances and commonly useful defense-in-depth directives.
Result
Website security observations
What to review
Read the finding in context.
frame-ancestors
This directive controls which origins may embed a document and is the preferred modern clickjacking control.
object-src
A restrictive object-src policy can reduce legacy object/plugin attack surface.
base-uri
base-uri can prevent an injected base element from rewriting how relative links and form targets are resolved.