Content-Security-Policy Evaluator
Paste a Content-Security-Policy and get each directive explained, plus findings for unsafe-inline, unsafe-eval, wildcards, missing object-src, base-uri and frame-ancestors.
Free · No sign-up · Your inputs stay in your browser
Input
Evaluate a Content-Security-Policy
Output
1 high, 2 medium
| Severity | Finding |
|---|---|
| high | script-src allows 'unsafe-inline' with no nonce or hash, so an injected <script> runs. This removes most of what a CSP is for. |
| medium | No object-src 'none'. Plugins are mostly gone, but it costs nothing to close. |
| medium | No base-uri. Set base-uri 'self' or 'none'. |
| low | No frame-ancestors, so any site can frame this page (clickjacking) unless X-Frame-Options is also sent. |
| Directive | Sources | What it controls |
|---|---|---|
| default-src | 'self' | Fallback for every fetch directive that is not set. |
| script-src | 'self' 'unsafe-inline' https://www.googletagmanager.com | Where scripts may load from and whether inline scripts run. |
| style-src | 'self' 'unsafe-inline' | Stylesheets and inline styles. |
| img-src | * data: | Images. |
| connect-src | 'self' https://api.example.com | fetch, XHR, WebSocket and EventSource targets. |
Roll a policy out with Content-Security-Policy-Report-Only first and watch the reports for a week: the first enforced policy always breaks something nobody remembered was loaded. Directives follow CSP Level 3.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The directive that matters most
A CSP's main job is to stop injected scripts. If script-src allows 'unsafe-inline' without a nonce or hash, an injected <script> runs and most of the protection is gone. A policy built on per-request nonces with 'strict-dynamic' avoids maintaining an allow-list of hosts at all; the CSP Level 3 specification describes how they interact.
Rolling one out
Send the policy as Content-Security-Policy-Report-Only first, collect violation reports for a week or two, and switch to enforcing only when they are quiet. Analytics tags, embedded videos and payment widgets each need sources added.
