CSP Analyzer
Paste a CSP value, a Content-Security-Policy header line, or full HTTP response headers to review directives, detect source concerns, and see a structured policy summary. Both enforcing and report-only policies are analyzed separately. Analysis runs entirely in your browser; no server is contacted.
Analyze a pasted Content-Security-Policy value or full response headers, classify directives and source expressions, and surface risky or ambiguous policy patterns for review.
How to analyze a CSP
- Paste a CSP value, a CSP header line, or a full HTTP response header block.
- Run the analyzer to view enforcing and report-only policies, directives, source expressions, and review counts.
- Inspect notices for duplicate directives, empty values, wildcards, unsafe-inline, unsafe-eval, and missing object-src/default-src fallback.
What the analyzer checks
Known fetch directives include default-src, script-src, style-src, img-src, font-src, connect-src, media-src, object-src, frame-src, child-src, worker-src, and manifest-src, plus several document and reporting directives.
The tool classifies self, none, wildcard, unsafe-inline, unsafe-eval, nonce, hash, strict-dynamic, scheme, and host sources. It marks wildcard, unsafe-inline, unsafe-eval, duplicate directives, none mixed with other sources, and missing object-src/default-src for review.
Privacy and limitations
The CSP is parsed entirely from text in your browser and no resource, page, script, image, or report endpoint is requested. This is a structural policy reviewer, not a browser CSP enforcement engine or a proof that the application is secure against XSS.
CSP Analyzer FAQ
Does it load the page covered by the CSP?
No. Paste the policy or response headers.
Does it recognize report-only policies?
Yes. Content-Security-Policy-Report-Only is displayed separately.
Does it flag unsafe-inline and unsafe-eval?
Yes. Both are review conditions for supported fetch directives.
Does a clean result prove my site is secure?
No. CSP is only one layer and this tool performs structural checks.
Does it contact report-uri or report-to endpoints?
No. No network requests are made.