CSP source keyword 'unsafe-hashes' usage

Questions about this rule

Does SEC_CSP_SOURCE_UNSAFE_HASHES affect my score?

Yes. It is an importance 3 rule at SPECIFICATION confidence, so a failure costs 3 × 1 points of impact in the Security category before that category is normalised to 100.

What does SPECIFICATION confidence mean?

A standard says so: HTML, WCAG, an RFC or Google's own documentation. Confidence is a declared tier rather than a per-rule number, so every rule backed by the same class of evidence carries the same weight - which is what makes the score reproducible instead of hand-tuned.

How do I check SEC_CSP_SOURCE_UNSAFE_HASHES on my own site?

Paste your URL into the box above and it runs only this rule, usually in a couple of seconds. It is also included in the Security checker and in a full scan.