Parses every directive, flags unsafe-inline/eval, wildcards, and missing protections. Grades A+ through F.
Based on CSP Level 3 and OWASP guidance.
Parses a Content Security Policy header or meta tag and evaluates each directive: default-src, script-src, style-src, img-src, connect-src, frame-ancestors, and more. Flags unsafe values like unsafe-inline, unsafe-eval, and wildcard sources that undermine the policy.
A CSP that contains script-src 'unsafe-inline' or default-src * provides little real protection. This tool identifies those weaknesses and explains why each directive matters.
Content Security Policy is one of the most impactful browser security controls for web applications, and also one of the most commonly misconfigured. A well-crafted CSP can prevent XSS payloads from executing even when an injection vulnerability exists.
Most CSP implementations start with overly permissive policies that get tightened over time. This tool helps you understand where a policy stands today, what risk each configuration creates, and what a stronger policy would look like.