$39 one-time · $29 baselines only when that is the eligible path · Paddle · 14-day no-exception refund · 9213651 Canada Inc.

A Report-Only CSP you can paste. It blocks nothing.

Report-Only blocks nothing. Not a WAF. Not a pentest. Not an A grade. We never edit your live site.

Paste a public URL. This sandbox proof uses a named fixture inventory, not a live crawl. If the fixture is eligible, attest, pay the matching price, and download a zip. You paste. No-code hosts do not buy the $39 CSP pack.

URL

No check yet.

I understand HeaderKit ships a Content-Security-Policy-Report-Only pack and baseline header notes from a fixture inventory — Report-Only blocks nothing. Baselines are hygiene, not protection. This is not a WAF, not a pentest, not legal advice, and not an A+. HeaderKit does not edit my live site. I will paste. A bad paste can break the site; I will keep the rollback notes. Refunds do not restore a host file I already published. CORS and SRI notes, if present, are not a separate product.

PASS means the expected Report-Only policy and sold baselines were observed on a response. It is not a security grade, not an A+, and not a pentest pass. We never edit your live site. Report-Only blocks nothing.

Support: idealstoronto@gmail.com