Analyze Content Security Policy headers from any URL or paste a CSP string directly. Get a security grade, per-directive breakdown, and actionable violation details.
Enter a URL to fetch and analyze its Content Security Policy header
Content Security Policy (CSP) is an HTTP response header that tells browsers which scripts, styles, images, and other resources are allowed to load. A well-crafted CSP is one of the most effective defenses against cross-site scripting (XSS) attacks.
The most important directive is default-src - it acts as a fallback for any resource type not explicitly listed. A good starting policy is default-src 'self' to allow only same-origin resources, then add specific allowances for CDNs or third-party services as needed.
The two most common CSP weaknesses are 'unsafe-inline' (allows all inline scripts and styles) and 'unsafe-eval' (allows eval() and dynamic code execution). Avoid both. Use nonces or hashes instead of 'unsafe-inline' if you need inline scripts. The Content-Security-Policy-Report-Only header lets you test a new policy without enforcing it.
Sent to our server: URL. Everything else in this tool runs in your browser. We fetch files from that site. To answer a repeated check fast, we have to keep answers for 5 minutes; then they are deleted. Also added to the page link, so you can share the result: URL.