web

Scan a website's Content-Security-Policy

Crawl up to 20 same-origin pages (45s total budget), analyze the current Content-Security-Policy (enforce header, Report-Only header, or meta tag), detect weaknesses such as unsafe-inline, wildcard sources, and missing object-src/base-uri/frame-ancestors, inventory every external resource origin per directive, and synthesize a ready-to-deploy starter policy (enforce + Report-Only variants). Expensive endpoint: limited to 3 scans per 10 minutes per IP; results are cached per origin for 10 minutes so repeat scans are instant. A scan typically takes 30-45 seconds.

post/csp/scan

Request

  • Base URL: https://intodns.ai/api
  • URL: https://intodns.ai/api/csp/scan
  • Auth: none required

Request body

urlstring required

Site to scan. A bare hostname is treated as https://

strictboolean

Synthesize a stricter policy

Example request

{
  "url": "https://example.com"
}

Response

CSP scan completed

urlstring

Normalized start URL of the crawl

originstring
pagesCrawledinteger

Number of same-origin pages successfully crawled (max 20)

pagesFailedinteger
truncatedboolean

True when more pages were discovered than the crawl budget allowed

inlineScriptsinteger

Total inline script blocks across crawled pages

inlineStylesinteger
eventHandlerAttrsinteger

Total inline event-handler attributes (onclick, onload, ...)

Example response

{
  "origin": "https://example.com",
  "findings": [
    {
      "directive": "script-src"
    }
  ],
  "inventory": [
    {
      "directive": "script-src"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.