CSP Evaluator
Check a Content-Security-Policy for weaknesses and see how to fix each one.
Runs in your browser Your input never leaves your device.
Paste the value of the header, or the whole header line. Several comma-separated policies are evaluated together. Nothing is sent anywhere: this runs in your browser.
Report a problem with this tool
About this tool
A Content-Security-Policy tells the browser which sources of script, images and other content a page may use, and a good one stops most cross-site scripting (XSS) even when an attacker manages to inject HTML. A weak one only looks protective. Paste a policy, or the whole header line, and this tool parses it the way browsers do (the first copy of a duplicated directive wins) and checks it. It flags 'unsafe-inline' and 'unsafe-eval', whole-scheme sources such as https: or data:, wildcards, a missing object-src or base-uri, hosts that serve attacker-usable script (public CDNs and cloud storage), nonces that are too short, 'strict-dynamic' used without a nonce, deprecated directives, missing semicolons, unquoted keywords such as self, and misspelled directive names with a suggestion. Each finding says what is wrong and how to fix it, and the overall rating tells you whether the policy is strict (nonces or hashes with 'strict-dynamic'), reasonable, weak or very weak. The core rules were compared with Google's open-source CSP Evaluator on thousands of policies, including real ones from large websites. Report-Only policies and several comma-separated policies are handled. Nothing is uploaded; the check runs in your browser.
How to use it
- Copy the Content-Security-Policy (or Content-Security-Policy-Report-Only) header value from your browser's developer tools or your server config.
- Paste it in the box. The result updates as you type.
- Fix the high and medium findings first, then the lower ones.
- Test the new policy in Report-Only mode before enforcing it.
Common problems
- It says 'unsafe-inline' is a problem but my policy has nonces
- When a nonce, hash or 'strict-dynamic' is present, browsers ignore 'unsafe-inline', so it is shown as a harmless fallback note, not a problem.
- A host I need is flagged as a bypass risk
- Host lists can be abused when the host serves arbitrary or user-supplied script. Prefer nonces with 'strict-dynamic', which do not rely on host lists, or self-host the script.
- My policy is a meta tag, not a header
- Paste the content attribute value. Note that frame-ancestors, report-uri and sandbox are ignored in a meta tag.