CSP policy analyzer
Paste a Content-Security-Policy header to spot permissive or missing directives (unsafe-inline, unsafe-eval, * wildcards, absent key directives). The analysis runs entirely in your browser.
How it works
Content-Security-Policy (CSP) is an HTTP header that restricts the sources allowed to load or execute content on a page (scripts, styles, images, fonts...), limiting the impact of an XSS flaw. This tool splits the pasted header directive by directive and applies a list of common heuristic rules to spot overly permissive configurations.
Why is 'unsafe-inline' flagged as dangerous?
With 'unsafe-inline', any script injected directly into the HTML (for example via an XSS flaw) runs normally — CSP then doesn't block much on this specific point, which cancels out a large part of the protection's value for inline scripts.
Does this tool verify the CSP actually applied by my site?
No: it only analyzes the text you paste. To verify the CSP actually sent by your server, inspect the HTTP response headers in your browser's developer tools (Network tab) and paste the value here.
Privacy: analysis is done entirely in your browser — the pasted policy is never sent to a server.