CSP Checker
Paste a Content-Security-Policy or enter a URL to find unsafe-inline, wildcards and missing directives, with a score and a fix for each
Pasted policies are checked in your browser and never sent anywhere. Check URL asks our server to request that page once and read its headers. Scores are this tool's own guide, not a standard. See every response header in the Security Headers Checker.
Was the CSP Checker helpful?
About this tool
The CSP Checker reads a Content-Security-Policy the way a browser does and tells you what it really protects. Paste a policy, or enter a URL to check what that page sends, and get a score plus a specific fix for each problem. It looks for what undermines a policy: 'unsafe-inline' and 'unsafe-eval', wildcards and bare schemes like https: in script sources, data: URLs, shared CDN hosts that can be used to get around an allowlist, short nonces, keywords missing their quotes, 'none' mixed with other sources, duplicate directives and obsolete ones. It also catches the directives people miss because they don't inherit from default-src: base-uri, form-action and frame-ancestors. The rules account for how browsers actually behave. 'unsafe-inline' is ignored when a nonce or hash is present, so it isn't flagged as a hole there, and allowlisted hosts are ignored under 'strict-dynamic'. A Report-Only policy is flagged because it doesn't block anything. Pasted policies never leave your browser.
When to use it
- →Reviewing a policy before you deploy it
- →Checking what a live site actually sends, after CDNs and frameworks have had their say
- →Finding out why a security scanner flagged your CSP
- →Learning why a policy that looks strict can still be bypassed
Tips
- ◆Nonces with 'strict-dynamic' are usually stronger and easier to maintain than a long list of allowed hosts.
- ◆Roll out with Content-Security-Policy-Report-Only first, then switch to enforcing once the reports are clean.
- ◆A nonce has to be new on every response. Check by reloading the page and comparing.
- ◆The URL check reads response headers only. Paste a policy from a <meta> tag to check that.
- ◆frame-ancestors, report-uri and sandbox don't work in a <meta> tag, so those need a real header.
Frequently asked questions
What's wrong with 'unsafe-inline'?
CSP's main job is to stop injected scripts from running. 'unsafe-inline' allows inline <script> tags and onclick-style handlers, which is what an XSS attack injects, so it removes most of the protection. Use nonces or hashes for the inline scripts you need.
Why is a CDN like cdn.jsdelivr.net flagged?
Anyone can publish files on public CDNs, so allowing the whole host allows an attacker's script too, as well as old library versions with known bypasses. Allow an exact file path, or use nonces instead.
Which directives don't fall back to default-src?
base-uri, form-action, frame-ancestors, sandbox and the reporting directives. Setting default-src 'self' doesn't restrict them, so they need setting explicitly.
What does the score mean?
It starts at 100 and loses 25 for each high issue, 10 for medium and 3 for low, and notes cost nothing. It's this tool's own guide for comparing policies, not an industry standard, and a good score doesn't replace fixing XSS in your code.
ToolNinja