API & Web

Content Security Policy Analyzer

Breaks a CSP into directives, flags the parts that weaken it and names the ones that are missing.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the policy, with or without the Content-Security-Policy: prefix.
  2. Select Analyse.
  3. Deal with any unsafe-inline, unsafe-eval or bare wildcard first — those are the ones that undo most of the policy.
  4. Check for any directive reported as unknown. A misspelled directive is ignored entirely, so the policy looks longer than it is.

What csp analyzer does

A Content-Security-Policy is one long line with no punctuation to help you, which is why the weaknesses in one are so easy to miss. Each directive is broken out with its sources, and the three that undo most of the value — unsafe-inline, unsafe-eval and a bare wildcard — are called out wherever they appear rather than only in script-src.

A misspelled directive is reported, because browsers ignore an unrecognised directive in full and silently: the policy looks longer and protects less. Absent protections are listed too — no default-src leaving fetch directives unrestricted, no frame-ancestors, no base-uri. This reads the policy text only; whether your pages still work under it is what report-only mode exists to answer.

Frequently asked questions

Inline script and style — anything in an on-click attribute or between script tags in the page. Blocking that is the main thing a CSP does against cross-site scripting, so a policy with unsafe-inline in script-src is providing very little protection, however long the rest of it is.

No, it is the standard pattern. A browser that understands nonces ignores unsafe-inline when one is present, so the unsafe-inline is only a fallback for older browsers. The page notes this where it sees both, so the combination is not reported as a weakness when it is deliberate.

Because browsers ignore directives they do not recognise, silently and in full. A policy with frame-ancesotrs in it has no frame-ancestors protection at all, and nothing anywhere reports an error. A long policy that has been quietly disarmed by a typo looks exactly like a working one.

No. It reads the policy text; it cannot see your pages, your scripts or the third parties they load. Deploy a new policy as Content-Security-Policy-Report-Only first, collect the violation reports for a week, and only then enforce it.