What this tool checks
Content-Security-Policy isn't one setting — it's a list of directives, each controlling a different kind of resource a page can load (scripts, styles, images, frames, and where the page itself can be embedded). A policy can be technically "present" while still being nearly useless, if the directives that matter most are missing or set too loosely. This tool parses each directive on its own and grades it individually, instead of treating CSP as a single pass/fail header.
The six directives this tool grades
default-src is the fallback for every fetch directive that isn't set explicitly — without it, there's effectively no baseline. script-src is the one attackers care about most, since it decides whether an injected <script> tag can run at all. object-src 'none' closes an old plugin-based injection path that has no legitimate use on a modern site. base-uri stops an injected <base> tag from silently rewriting every relative link on the page. frame-ancestors is CSP's own clickjacking defense, independent of X-Frame-Options. upgrade-insecure-requests auto-upgrades any leftover http:// sub-resource on an otherwise https:// page.
Report-Only isn't protection
Content-Security-Policy-Report-Only is a genuinely useful tool for testing a new policy without risking breakage — violations get logged instead of blocked. But a site that only ever sets the Report-Only header, and never the enforced one, has effectively no CSP at all: nothing is actually stopped. This tool flags that distinction explicitly rather than treating both headers as equivalent.