No Login Data Private Local Save

CSP Analyzer - Online Test & Improve Policy

25
0
0
0

CSP Analyzer – Test & Improve Policy

Paste a Content-Security-Policy header value or enter a URL to fetch it automatically. Identify weaknesses, get improvement suggestions, and generate a hardened policy.

You can also drag & drop a .txt file or paste from clipboard.
Attempts to retrieve CSP via fetch. If blocked, paste the policy manually.

Frequently Asked Questions

Content Security Policy is an added layer of security that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. It allows web developers to define approved sources of content for their site.

CSP misconfigurations can leave your site vulnerable while over-restriction can break functionality. Our analyzer inspects each directive, flags risky values (like 'unsafe-inline', *), and suggests hardened alternatives to balance security and compatibility.

We evaluate all standard fetch directives: default-src, script-src, style-src, img-src, connect-src, font-src, object-src, media-src, frame-src, worker-src, and others. Also checks for base-uri, form-action, etc.

High – Allows inline scripts/styles, eval, or wildcards that enable XSS. Medium – Uses loose schemes like http: or data:. Low – Mostly secure with minor improvements possible.

The optimizer removes 'unsafe-inline', 'unsafe-eval', replaces wildcard * with 'self', and upgrades http: to https:. It also suggests adding 'strict-dynamic' when nonces/hashes are present. Always test the generated policy before deploying.

Yes, enter a full URL and click Fetch. The tool tries to read the Content-Security-Policy response header. Due to browser CORS restrictions, this may not always succeed. In such cases paste the header value manually (you can copy it from DevTools → Network → Response Headers).
🔧 Related Tools