Where possible, ControlCurrent links each security feature to the relevant Web Platform Tests. These public tests help show how browsers are checked against web standards. They do not test or certify your website.
“Reviewed test source” opens the exact version checked for this site. “Latest public results” opens the live results, which can change over time.
Policy parsing and enforcement behaviour across the CSP test suite.
content-security-policyreviewed test sourcelatest public resultsLimit: Suite coverage does not establish that an application's policy is complete, effective, or deployed on every response.
Nonce source parsing and script authorisation behaviour.
content-security-policy/script-srcreviewed test sourcelatest public resultsLimit: The mapping covers browser behaviour, not nonce unpredictability, per-response generation, reuse, or disclosure.
Hash source parsing and authorisation for inline script and style content.
content-security-policy/script-srcreviewed test sourcelatest public resultscontent-security-policy/style-srcreviewed test sourcelatest public resultsLimit: The mapping does not establish that deployed hashes match every intended resource or remain current.
strict-dynamic parsing, trust propagation, and fallback interactions.
content-security-policy/script-srcreviewed test sourcelatest public resultsLimit: Passing behaviour does not establish that an application's trusted loaders are safe.
Base URL authorisation and blocking behaviour.
content-security-policy/base-urireviewed test sourcelatest public resultsLimit: The suite does not establish that an application prevents every unsafe absolute URL.
Embedding authorisation across same-origin, cross-origin, nested, and sandboxed cases.
content-security-policy/frame-ancestorsreviewed test sourcelatest public resultsLimit: The mapping does not establish that the deployed allowlist matches an application's intended embedding relationships.
Form destination authorisation, redirects, and target behaviour.
content-security-policy/form-actionreviewed test sourcelatest public resultsLimit: The suite does not evaluate scripted requests, server authorisation, or whether every legitimate destination was inventoried.
Eligible request rewriting and mixed-content interactions.
upgrade-insecure-requestsreviewed test sourcelatest public resultsLimit: The mapping does not prove that every upgraded endpoint supports correct HTTPS.
Sandbox token behaviour across frames, workers, redirects, and navigations.
content-security-policy/sandboxreviewed test sourcelatest public resultsLimit: The suite cannot determine whether an application's selected sandbox tokens grant excessive capability.
Trusted Types APIs, policy behaviour, CSP enforcement, and protected DOM sinks.
trusted-typesreviewed test sourcelatest public resultsLimit: The mapping does not establish complete sink coverage or the safety of application-authored policies.
Integrity metadata parsing, digest matching, fetching, and CSP interactions.
subresource-integrityreviewed test sourcelatest public resultsLimit: The suite does not establish that a deployment supplies current integrity metadata for every eligible resource.
Integrity-Policy parsing, blocking, report-only behaviour, destinations, sources, and reporting integration.
subresource-integrity/integrity-policyreviewed test sourcelatest public resultsLimit: The suite does not establish that every production resource carries current metadata or that reports are operationally reviewed.
Browsing-context isolation, opener relationships, reporting, and navigation behaviour.
html/cross-origin-opener-policyreviewed test sourcelatest public resultsLimit: The mapping does not establish compatibility with an application's popup and cross-window integrations.
Cross-origin resource opt-in and embedder-policy enforcement.
html/cross-origin-embedder-policyreviewed test sourcelatest public resultsLimit: The suite does not establish that all production dependencies opt in correctly.
Resource-policy enforcement across fetch and embedding contexts.
fetch/cross-origin-resource-policyreviewed test sourcelatest public resultsLimit: The mapping does not determine the correct resource-sharing policy for an application.
Credential omission and embedding behaviour under credentialless COEP.
html/cross-origin-embedder-policy/credentiallessreviewed test sourcelatest public resultsLimit: The suite does not establish that credential omission is suitable for every embedded resource.
Origin-keyed agent-cluster opt-in and browsing behaviour.
html/browsers/origin/origin-keyed-agent-clustersreviewed test sourcelatest public resultsLimit: Agent clustering is not a guarantee of process isolation or an application authorisation boundary.
Sec-Fetch request-context header generation across request modes and destinations.
fetch/metadatareviewed test sourcelatest public resultsLimit: The mapping does not test an application's server-side resource-isolation policy.
Policy parsing, inheritance, delegation, and feature-specific enforcement.
permissions-policyreviewed test sourcelatest public resultsLimit: The suite does not establish that an application selected the correct capabilities or frame allowlists.
No exact suite mapping was retained at the reviewed revision.
No similar test is substituted when an exact link is unavailable.
Limit: Nearby HTTPS and navigation tests are not substituted for HSTS state, expiry, subdomain, or first-visit behaviour.
nosniff enforcement for relevant script, style, and fetch responses.
fetch/nosniffreviewed test sourcelatest public resultsLimit: The suite does not establish that a deployment sends correct Content-Type values for every response.
Directive parsing and browser-held data clearing behaviour.
clear-site-datareviewed test sourcelatest public resultsLimit: The mapping does not establish correct logout sequencing, server-side revocation, or coverage of every storage mechanism.
Policy parsing and referrer delivery across navigation and resource contexts.
referrer-policyreviewed test sourcelatest public resultsLimit: The suite does not establish that sensitive data is absent from URLs or other telemetry.
SameSite parsing and cookie delivery across same-site and cross-site contexts.
cookies/samesitereviewed test sourcelatest public resultsLimit: The mapping does not establish that session cookies use an appropriate value or replace CSRF protection.
Partition-key behaviour, redirects, subresources, and SameSite interactions.
cookies/partitioned-cookiesreviewed test sourcelatest public resultsLimit: The mapping does not establish that a deployment needs partitioned state or declares all required attributes.
No exact suite mapping was retained at the reviewed revision.
No similar test is substituted when an exact link is unavailable.
Limit: General cookie tests are not substituted for the intended claim that script access is prevented by HttpOnly.
__Secure-, __Host-, __Http-, and __Host-Http- prefix constraint behaviour.
cookies/prefixreviewed test sourcelatest public resultsLimit: Prefix enforcement does not establish sound session design or protection from every cookie-confusion attack.
WebAuthn API and authenticator-availability behaviour within the WebAuthn suite.
webauthnreviewed test sourcelatest public resultsLimit: The suite does not establish relying-party verification, recovery safety, or authenticator policy.
PRF extension parsing and credential operation behaviour within the WebAuthn suite.
webauthnreviewed test sourcelatest public resultsLimit: The mapping does not establish authenticator support in a user's environment or a safe key-recovery design.
Conditional mediation and related PublicKeyCredential behaviour within the WebAuthn suite.
webauthnreviewed test sourcelatest public resultsLimit: The suite does not establish a secure account, autofill, or recovery experience.
MDN data records which browsers support a feature. Web Platform Tests exercise standard browser behaviour. ControlCurrent can also check configuration information that you supply. None of these can see the full security design of a production website.
ControlCurrent does not turn live public test results into a percentage. The selected tests, browser version, test infrastructure, expected failures, and incomplete runs all need context that a single score would hide.
Some Web Platform Tests (WPT) also require automation and cannot be run in an ordinary browser session.