CSP checker

What CSP does

Content-Security-Policy is a response header that tells the browser which sources a page is allowed to load scripts, styles, images and other content from - a second line of defense if an attacker manages to inject content into the page, since even injected content still has to satisfy the policy to actually execute or load.

Reading a directive list

A policy is a semicolon-separated list of directives, each naming a resource type (script-src, img-src, connect-src, and so on) followed by the sources allowed for it. default-src is the fallback for any resource type not given its own directive. This tool splits the raw header into exactly that structure.

What gets flagged, and why

• 'unsafe-inline' / 'unsafe-eval' in script-src - these opt back out of CSP's main protection, allowing inline scripts or dynamic code execution CSP was largely designed to stop.
• A bare wildcard (*) in script-src - scripts may load from anywhere.
• Missing object-src / base-uri / frame-ancestors - each closes a specific, well-known bypass technique when absent.

This is pattern-matching against the policy text, not a security audit of whether the policy actually fits the page's real script and style inventory - a policy can look permissive but be exactly what a page legitimately needs, or look tight and still miss something specific to that page.

Related tools

See security headers checker for CSP alongside every other security header, and CORS checker for the separate cross-origin permission model.