Free CSP Evaluator and Builder
Paste a Content Security Policy to see what would let an injected script run, ranked by severity, and export a clean header or meta tag.
What is a CSP Evaluator and Builder?
A Content Security Policy is a response header that tells the browser which scripts, styles and other resources a page may load. A good policy stops injected scripts from running. This tool checks a policy for the gaps that would let them through, and exports it as a header or meta tag.
Parsing follows CSP Level 3: directive names are case-insensitive, a repeated directive is ignored after the first, and script rules fall back to default-src. The checks are modelled on Google’s CSP Evaluator, covering unsafe-inline, wildcards, data: scripts, unquoted keywords, missing object-src and base-uri, and strict-dynamic without a nonce.
Key Features
Findings Ranked by Severity
High findings let an injected script run; medium and low weaken the policy; info notes are worth a look. Fix from the top.
Catches Easy-to-Miss Typos
self without quotes, a misspelled directive or a comma instead of a semicolon each silently breaks a policy. They’re flagged by name.
Understands Nonces and strict-dynamic
When a nonce or hash is present, 'unsafe-inline' is reported as ignored rather than dangerous, just as modern browsers treat it.
Header or Meta Tag Output
Export the cleaned policy as a response header, or as a meta tag with frame-ancestors and the reporting directives removed, since meta ignores them.
Evaluated Locally
Your policy, including internal host names, is checked in the browser and never uploaded.
Perfect for everyone
- Web developers hardening a site
- Security engineers reviewing headers
- Teams preparing for a penetration test or security audit
How to Use the CSP Evaluator and Builder
Paste the policy, read the findings from the top, and export the fixed version.
Paste Your Policy
Copy the Content-Security-Policy header from your server config or the browser’s network panel. The header name, a Report-Only header or a whole meta tag are all accepted.
Fix High Findings First
High findings, such as 'unsafe-inline' without a nonce or a wildcard script source, let injected scripts run. Each explains the fix.
Review the Rest
Medium and low findings, such as a missing base-uri or frame-ancestors, close the remaining gaps. Info notes explain behaviour worth knowing.
Export the Header or Meta Tag
Switch to Header or Meta tag, copy the line, and deploy it, ideally as Report-Only first to watch for breakage.
Policies, Evaluated
Each answer is this tool’s output for the policy on the left, in the mode on the chip. Decide which finding is worst before revealing it.
“default-src 'self'; script-src 'self' 'unsafe-inline'”
“default-src *”
“script-src 'nonce-r4nd0m' 'strict-dynamic' https: 'unsafe-inline'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'”
“default-src self; object-src 'none'”
“script-src 'self' 'unsafe-eval'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'”
“img-src *; style-src 'self'”
“default-src 'self'; script-src 'self'; script-src *”
“default-src 'self'; frame-ancestors 'none'; report-to csp”
“default-src 'self', img-src *”
“default-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-reports”
The CSP Directives That Matter Most
A policy can have two dozen directives, but these ten decide most of its protection.
default-src
The fallback for fetch directives that aren’t set, such as script-src or img-src. It doesn’t cover base-uri, form-action or frame-ancestors.
“Does default-src cover form-action?”
script-src
Controls which scripts may run, and is the directive that stops cross-site scripting. Prefer nonces or hashes over host allowlists.
“Which directive mainly stops XSS?”
Nonces
A random value, new on every response, added to the policy and to each script tag. Only scripts carrying the nonce run.
“How often should a nonce change?”
Hashes
A SHA-256, SHA-384 or SHA-512 hash of an inline script’s exact text. It suits static pages where nonces are hard to add.
“Which hash algorithms does CSP accept?”
'strict-dynamic'
Trusts scripts loaded by an already-trusted script, and makes browsers ignore host allowlists. It needs a nonce or hash to start the chain.
“What does 'strict-dynamic' need to work?”
object-src
Controls plugins and embedded objects. Setting it to 'none' closes an old route for running script.
“What should object-src usually be?”
base-uri
Limits the base element. Without it, an injected base tag can point relative script URLs at an attacker’s server.
“Does default-src cover base-uri?”
frame-ancestors
Controls which sites may frame the page, replacing X-Frame-Options. It only works in a header, not a meta tag.
“Which header did frame-ancestors replace?”
upgrade-insecure-requests
Tells the browser to fetch HTTP resources over HTTPS instead. It helps when migrating an old site to HTTPS.
“Does upgrade-insecure-requests take sources?”
report-to
Names a Reporting-Endpoints group that receives violation reports. It replaces report-uri, which many sites send alongside it.
“Which directive replaces report-uri?”
Rolling Out a Policy Safely
A strict policy can break a site if it’s switched on all at once. This order keeps it working.
Start Report-Only
Send the policy as Content-Security-Policy-Report-Only first. Browsers report what would be blocked without blocking it.
Collect Violation Reports
Point report-to at an endpoint and watch reports for a week or two. They show inline scripts and third-party hosts you forgot.
Add Nonces to Your Templates
Generate a random nonce per response and add it to every script tag. Frameworks such as Next.js and Django have built-in support.
Move Inline Handlers to Scripts
onclick attributes and javascript: URLs can’t carry a nonce. Replace them with event listeners in script files.
Enforce, Then Keep Reporting
Switch to the enforcing header once reports go quiet, and keep report-to so new problems still surface.
Re-Evaluate After Changes
New third-party widgets often come with instructions to add 'unsafe-inline'. Check the policy again before accepting that.
CSP Mistakes
These are the reasons policies that look strict let scripts through anyway.
Unquoted Keywords
self, none and unsafe-inline must be in single quotes. Unquoted, self is read as a host called self and does nothing.
'unsafe-inline' Without a Nonce
It allows every inline script, which is exactly what XSS injects. Add nonces, and the keyword becomes a harmless fallback.
Wildcards in script-src
Star or https: allows scripts from any HTTPS site, including one an attacker runs. Name hosts, or better, use nonces.
Allowlisting CDNs That Host Everything
Allowing a public CDN lets attackers load any old library hosted there, including ones with known script gadgets.
Forgetting object-src and base-uri
default-src covers object-src but not base-uri, and a strict script-src is easy to undermine without both.
Two Policies by Accident
Sending two CSP headers, or joining policies with a comma, enforces both, so the stricter rule wins everywhere. That can break pages unexpectedly.
Static Nonces
A nonce that never changes is a password published in every page. Generate a new random value for each response.
Relying on a Meta Tag
A meta tag can’t set frame-ancestors or reporting, and it only applies to content after it. Send the header when you can.
When to Check a Policy
Before deploying a policy, after changing one, and during any security review.
Auditing an Existing Site
Paste the header from production to see whether it would actually stop an injected script.
Preparing for a Pen Test
Fix high-severity findings before testers report them, so the engagement covers deeper issues.
Reviewing a Config Change
When a pull request edits the policy, check that a new host or keyword didn’t weaken it.
Adding a Third-Party Widget
Test the policy with the widget’s required sources to see what they open up.
Building a First Policy
Start from a strict nonce template, evaluate it, and export the header for your server or CDN.
Converting to a Meta Tag
For static hosts that can’t set headers, export a meta tag and see which directives you’ll lose.
Learning CSP
Change one source at a time and watch findings appear and disappear, which makes the fallback rules clear.