Tools / CSP Analyzer
CSP Header Analyzer
Paste a Content-Security-Policy header value to check it for unsafe directives, missing hardening, and deprecated syntax. Nothing is sent to a server.
Paste just the header value (everything after Content-Security-Policy:). Start from a template and edit it, or paste your own header to audit it.
- info
No report-uri or report-to set — violation reports aren't collected, so silent breakage or attempted attacks go unnoticed.
// About this tool
CSP Header Analyzer
This tool parses a Content-Security-Policy header value into its individual directives and checks each one against a set of known-risky patterns: 'unsafe-inline' and 'unsafe-eval' in script-src, wildcard (*) sources, missing object-src or base-uri, absent frame-ancestors, and directives with no violation reporting configured.
It also flags duplicate directives (browsers only honor the first occurrence of a fetch directive) and deprecated directives like block-all-mixed-content that current browsers silently ignore.
Two starting templates are included — a strict baseline with no unsafe- keywords, and a looser report-only starting point for policies being rolled out gradually. Both can be edited directly in the textarea.
// When to use it
Review a CSP before shipping it
Paste the header your app is about to send and fix every error/warning before it goes to production.
Audit a live site's policy
Copy the Content-Security-Policy value from a site's response headers (DevTools → Network) and paste it in to see what it actually restricts.
Start a new policy from scratch
Load the strict baseline template, then loosen individual directives only as far as your app's assets require.
// Questions
Does this check the live headers of a URL?
No — this tool only analyzes a header value you paste in. It doesn't fetch anything, by design, so it works entirely offline.
Why is 'unsafe-inline' flagged as an error?
'unsafe-inline' allows any inline <script> tag to execute, which removes most of what CSP protects against for cross-site scripting. A nonce or hash-based allowlist achieves the same functionality safely.
What does 'directive appears more than once' mean?
For fetch directives (script-src, style-src, etc.), browsers only apply the first occurrence in a single CSP header and silently ignore any repeats of the same directive name — a common source of policies that don't do what their author expects.
// Related tools