CSP Checker

Review a Content Security Policy for risky directives.

Content-Security-Policy

What Is a CSP Checker?

The CSP Checker reviews a Content Security Policy string and flags directives and source values that weaken protection. It detects unsafe-inline, unsafe-eval, wildcards, http:// sources, data: URIs, repeated or unknown directives, and reminds you about missing default-src and object-src.

How to Use This CSP Checker

1
Paste your policyEnter your Content-Security-Policy header value.
2
Review each directiveRead the assessment of every source value.
3
Read the warningsAct on the listed risks and hardening tips.

Frequently Asked Questions

A CSP is a browser security mechanism that tells the browser which sources of scripts, styles, and other resources are allowed, reducing the impact of injection attacks.

It allows the browser to run inline scripts, which can enable cross-site scripting. Modern policies favor nonces or hashes instead.

Without restricting object-src, plugins and embeds may be allowed, which can expand the attack surface. Setting it to 'none' is a common hardening step.

Related Security & Privacy Tools

Password Generator

Generate strong random passwords with full control.

Random Password Generator

Create secure random passwords instantly.

Password Strength Checker

Evaluate how strong a password really is.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 and SHA-3 hashes.

JWT Decoder

Decode the header and payload of a JWT token.

JWT Inspector

Decode a JWT and check exp, nbf and algorithm claims.

More Security & Privacy Tools

SSL Certificate Checker

Read and analyze the TLS certificate a server presents.

SSL Expiry Checker

See how many days remain until a certificate expires.

Security Headers Checker

Verify the presence of essential security headers.

HTTP Headers Analyzer

Fetch and inspect every response header of a URL.

CORS Checker

Analyze CORS headers for misconfigurations.

Cookie Analyzer

Check cookies for Secure, HttpOnly and SameSite flags.