Cross-site scripting attacks are all-too-common and Content Security Policy on most websites provide no security protection. Google's CSP Evaluator and CSP Mitigator tools address the configuration ...