Top 10k sites	4 websites
Top 100k sites	14 websites
Top 1m sites	56 websites

See full domain list
Flat price per the report, subscription is not required.

Header value	Value prevalence
default-src 'self' https: 'unsafe-inline' 'unsafe-eval'; report-uri content.php?action=150&module=core&handler=ContentSecurityPolicyHandler&mode=reportCspViolation; report-to content.php?action=150&module=core&handler=ContentSecurityPolicyHandler&mode=rep	31.09%
default-src 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline'; script-src-attr 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; img-src * data: zixx: zixxs: cid: file: blob:; font-src * data:; connect-src 'self' www.googleapis.com apis	24.38%
frame-ancestors 'self'; report-uri /csp_logger	6.72%
default-src 'self' https://static.eole-web.fr http://static.eole-web.fr; script-src 'self' 'unsafe-eval' data: http://cdn.ckeditor.com https://cdn.ckeditor.com http://connect.facebook.net https://connect.facebook.net https://platform.twitter.com http://pl	4.22%
default-src 'self' https: 'unsafe-inline' 'unsafe-eval'; report-uri content.php?action=150&module=core&handler=ContentSecurityPolicyHandler&mode=reportCspViolation;	3.75%
default-src 'self'; report-uri /admin/config/system/seckit/csp-report	2.97%
default-src 'self'; report-uri /report-csp-violation	2.19%
report-uri /report-csp-violation; upgrade-insecure-requests	2.19%
default-src 'self' data: *; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' *; object-src 'self' data: *; style-src 'self' data: 'unsafe-inline' *; img-src 'self' data: *; media-src 'self' data: *; frame-src 'self'; font-src 'self' data: *; connect-	1.88%
default-src 'self' 'unsafe-inline' 'unsafe-eval' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' 'unsafe-inline' 'unsafe-eval' *; style-src 'self' 'unsafe-inline' 'unsafe-eval' *; img-src 'self' 'unsafe-inline' 'unsafe-eval' *; med	1.72%
report-uri /report-csp-violation	1.56%
base-uri 'self'; default-src 'none'; child-src; connect-src 'self' https://rec.smartlook.com http://rec.smartlook.com rec.smartlook.com https://apikeys.civiccomputing.com http://apikeys.civiccomputing.com apikeys.civiccomputing.com https://ig.instant-toke	1.41%
default-src https: 'unsafe-inline' 'unsafe-eval'; img-src https://* data: ; frame-src https://* about: javascript:	1.25%
default-src https: 'unsafe-inline' 'unsafe-eval' data: about: blob:; report-uri /_resources/php/csp-report.php	1.25%
base-uri 'self'; default-src 'self'; connect-src 'self' https://track.connect.bcg.com https://heapanalytics.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://*.bcg.com https://bcg01.egnyte.com https://www.113.vovici.net https://play	1.09%
default-src https: 'unsafe-inline' 'unsafe-eval' data: about:; report-uri /_resources/php/csp-report.php	1.09%
default-src *	0.78%
default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; font-src *; connect-src *	0.63%
default-src 'unsafe-inline' 'unsafe-eval' 'self' *.googleapis.com *.gstatic.com *.google-analytics.com;	0.47%
default-src 'self'; report-uri /admin/settings/seckit/csp-report	0.47%