Start a project

Tool 88 of 100 · Security

CSP Evaluator

Paste a Content-Security-Policy and see where it would let an attack through, what each resource type is really allowed, and whether a given URL would load.

Use the tool All developer tools Live · free
CSP Evaluator at a glanceIllustration: 1, A CSP header; 2, processed in your browser; 3, Grade + fixes.CSP Evaluator1A CSP header3Grade + fixes2In yourbrowser
1 A CSP header 2 processed on your device 3 Grade + fixes

CSP Evaluator

Policy

Findings

DirectiveSeverityFinding

Would this load?

Effective rule per type

TypeSourcesInherited

01

What it does

Parses a Content-Security-Policy, flags XSS weaknesses, shows the effective rule per resource type and tests URLs against it.

  • CSP Level 3 parsing and fallback rules
  • Flags unsafe-inline, unsafe-eval, wildcards, data: and http:
  • Known bypassable script hosts
  • Missing object-src, base-uri and frame-ancestors

02

Private by design

Everything happens in your browser. Nothing you type, paste or upload is sent anywhere, and it keeps working offline once the page has loaded.

03

What you get

Findings and an effective-policy table, with a Copy and a Download button on every result.

  • CSP
  • XSS
  • Security
  • Headers

Why it matters

A Content-Security-Policy is the strongest defence against cross-site scripting, but only if it's strict. One 'unsafe-inline', a wildcard host or a CDN that serves old JSONP endpoints can make the whole policy decorative.

This evaluator applies the CSP Level 3 rules, including how each directive falls back to default-src, and flags the patterns security reviewers look for. The URL tester uses the spec's source-matching rules, so you can check a third-party script before it breaks in production. The Security Headers tool writes policies; this one checks them.

How it works

  1. InputA Content-Security-Policy header
  2. In your browserEach directive checked against CSP3 rules
  3. OutputA grade, findings and a URL tester

Where it fits in a designer's workflow

  1. Plan
  2. Design
  3. Build
  4. Test
  5. Launch
Hardening a site before launch.

By the numbers

Findings for the sample policy and the strict exampleSample policy (grade D): fail: 2; Sample policy (grade D): worth fixing: 4; Sample policy (grade D): pass: 0; Strict example (grade A+): fail: 0; Strict example (grade A+): worth fixing: 0; Strict example (grade A+): pass: 4Sample policy (grade D): fail2Sample policy (grade D): worth fixing4Sample policy (grade D): pass0Strict example (grade A+): fail0Strict example (grade A+): worth fixing0Strict example (grade A+): pass4
Graded by this tool's own checks. 'unsafe-inline' and wide allow-lists of CDNs are what let injected scripts run; a nonce with 'strict-dynamic' is the pattern Google recommends. Source: Content Security Policy Level 3; web.dev: strict CSP.
Show the numbers as a table
PolicyGradeFailWorth fixingPass
SampleD240
Strict exampleA+004

How to use it

  1. Paste a Content-Security-Policy header or just its value.
  2. Read the findings, most serious first.
  3. Check the effective rule for each resource type.
  4. Test a URL to see whether it would be allowed.

FAQ

What's a strict CSP?

One that allows scripts only with nonces or hashes (plus 'strict-dynamic'), sets object-src 'none' and base-uri 'none' or 'self'. Host allow-lists alone are often bypassable.

Why is a meta tag CSP flagged?

A CSP in a <meta> tag can't use frame-ancestors, report-uri or sandbox, and only applies to content after the tag. A header is better.

Does it fetch my site?

No. It only reads the policy you paste.

What's the difference from the Security Headers tool?

That tool generates headers. This one evaluates an existing CSP in depth and tests URLs against it.

Work with me

Want a site that gets these right?

I build fast, accessible websites and web apps that pass these checks from day one. Tell me about your project and I'll reply personally with honest next steps.

Start a project What I do

All developer tools · Back to leej.uk