CSP Checker

Review a Content Security Policy for risky directives.

Content-Security-Policy

What Is a CSP Checker?

The CSP Checker reviews a Content Security Policy string and flags directives and source values that weaken protection. It detects unsafe-inline, unsafe-eval, wildcards, http:// sources, data: URIs, repeated or unknown directives, and reminds you about missing default-src and object-src. This free online security tool is useful for CSP checker, Content Security Policy checker, CSP analyzer. Common use cases include reviewing CSP directives and identifying unsafe-inline, unsafe-eval, wildcard, HTTP source, and other policy weaknesses. It is designed for quick browser-based analysis and development workflows. Security checks are signals rather than guarantees, so production systems should also be validated against current standards and their specific threat model.

How to Use This CSP Checker

1
Provide the configurationPaste the relevant policy or response headers into the analyzer.
2
Run the analysisLet the tool inspect the supplied directives and values.
3
Review warningsIdentify settings that are missing, overly broad, unsafe, or inconsistent.
4
Compare with application needsA secure configuration must still allow the resources and cross-origin behavior your application requires.
5
Retest after changesUpdate the server configuration and run the analyzer again.

Frequently Asked Questions

A CSP is a browser security mechanism that tells the browser which sources of scripts, styles, and other resources are allowed, reducing the impact of injection attacks.

It allows the browser to run inline scripts, which can enable cross-site scripting. Modern policies favor nonces or hashes instead.

Without restricting object-src, plugins and embeds may be allowed, which can expand the attack surface. Setting it to 'none' is a common hardening step.

Related Security & Privacy Tools

Password Generator

Generate strong random passwords with full control.

Random Password Generator

Create secure random passwords instantly.

Password Strength Checker

Evaluate how strong a password really is.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 and SHA-3 hashes.

JWT Decoder

Decode the header and payload of a JWT token.

JWT Inspector

Decode a JWT and check exp, nbf and algorithm claims.

More Security & Privacy Tools

SSL Certificate Checker

Read and analyze the TLS certificate a server presents.

SSL Expiry Checker

See how many days remain until a certificate expires.

Security Headers Checker

Verify the presence of essential security headers.

HTTP Headers Analyzer

Fetch and inspect every response header of a URL.

CORS Checker

Analyze CORS headers for misconfigurations.

Cookie Analyzer

Check cookies for Secure, HttpOnly and SameSite flags.