Most checks ask whether you have a policy. This one reads it.
A security header is easy to add and easy to check for. What it actually permits is a different question, and it is the one that decides whether the header protects anyone. This tool grades the content, not the presence.
Content-Security-Policy: script-src 'unsafe-inline' https:Content, not presence
A Content-Security-Policy that allows inline scripts from any host is a policy that stops almost nothing, yet it is a policy. Read the way a browser reads it, its weaknesses are named one by one: inline and eval, wildcards, bare schemes, and shared platforms where anyone can host a payload. Nonces and strict-dynamic are honoured, so nothing counts against you that the browser already ignores.
A missing policy is the worst policy
Sending no policy is not a neutral absence. It leaves the page exactly where a wide-open policy leaves it, so it is priced as one. The number is derived by running that equivalent through the same rules, which means the tool can never tell you that deleting a header improves your grade.
Every verdict shows its evidence
The raw headers are printed underneath the report, and each finding points at the token it came from. Disagree with a call and you can see exactly what it was based on, rather than taking a letter on trust.
Not measured is never a failure
A check that could not run is reported as not tested, with its reason and no points lost. A timeout says nothing about the site, and dressing it up as a red cross would be inventing a result. Absence of a finding is never presented as proof that nothing is there.
And who can fix it
Every finding names where a fix can live: your application, a web server, the edge, the host, DNS or the network. Usually more than one. That is the difference between an afternoon of work and a phone call to a provider, and it is the part that turns a grade into something you can act on.
The result is a grade you can defend line by line, in plain language, with the evidence attached.