Network & Web Tools

Content Security Policy (CSP) Analyzer Online Free

Parse a Content Security Policy, highlight unsafe source expressions and find missing core directives.

Analyze a Content Security Policy

Paste the value of a Content-Security-Policy header. The policy stays in your browser.

Security grade

Score

82/100

Directives

default-src

'self'

script-src

'self'https://cdn.example.com

style-src

'self''unsafe-inline'

img-src

'self'data:

object-src

'none'

base-uri

'self'

frame-ancestors

'none'

upgrade-insecure-requests

Boolean directive

Risk findings

• style-src allows 'unsafe-inline'. Prefer nonces or hashes.

Missing recommended directives

All core directives are present.

About this tool

Content Security Policy helps reduce cross-site scripting and unwanted resource loading. This analyzer converts a raw policy into readable directives and surfaces common weaknesses such as unsafe-inline, unsafe-eval, wildcards and insecure HTTP sources.

Common use cases

✓ Review a CSP before production deployment.
✓ Audit policies generated by frameworks or CDNs.
✓ Find missing default, script, object and framing restrictions.
✓ Compare policy changes during security hardening.

How to use it

Paste the CSP header value without the header name.
Review parsed directives and source expressions.
Check risk findings and missing recommendations.
Update the policy carefully and test in Report-Only mode first.

Important interpretation notes

• Roll out strict policies gradually to avoid breaking legitimate resources.
• Nonces and hashes must be generated and applied correctly by the application.
• This tool provides heuristic guidance and is not a penetration test.

Related Network & Web Tools

Internet Speed Test IP Address Checker DNS Lookup SSL Certificate Checker Website Status Checker Redirect Checker HTTP Headers Checker View full collection

Frequently asked questions

What is Content Security Policy?

CSP is an HTTP response header that limits where a page may load scripts, styles, images, frames and other resources from.

Why is unsafe-inline risky?

It permits inline code or styles and can weaken CSP protection. Nonces or hashes are usually safer for scripts.

Does a high grade guarantee security?

No. CSP is one security layer and the actual application, endpoints, dependencies and browser behaviour still need review.

Can I test a Report-Only policy?

Yes. Paste the policy value itself; the parser treats it the same way for structural analysis.