Content-Security-Policy Checker
Evaluate any site's CSP — or paste a policy you're drafting — and see exactly which directives protect you, which don't, and what to change. Free, no signup.
This tool reads publicly available configuration (HTTP response headers). It performs no intrusive testing. Only scan domains you own or are authorized to assess.
What does a Content-Security-Policy checker test?
A Content-Security-Policy (CSP) is an HTTP header that gives the browser an allow-list of where scripts, styles, frames and other resources may load from. It is the strongest browser-side defence against cross-site scripting — but only when the directives are set correctly.
This checker reads the policy your homepage returns (headers and <meta> tags), resolves the fallbacks the way a browser does, and grades the result: unsafe-inline or wildcards in script-src, missing object-src / base-uri / form-action / frame-ancestors, report-only policies that enforce nothing, deprecated or misspelled directives, and missing violation reporting.
You can also paste a policy you are drafting. Nothing is fetched in that mode — the text is evaluated and returned with the missing hardening directives appended, ready to deploy in Report-Only first.
How to fix a weak CSP
Roll changes out in Content-Security-Policy-Report-Only first, watch the reports, then enforce:
- Replace 'unsafe-inline' in script-src with a per-response nonce (or hashes) plus 'strict-dynamic'.
- List exact script origins instead of *, https: or data:.
- Add object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'.
- Add report-to (with a Reporting-Endpoints header) so you learn what the policy blocks.
Common SSL problems and where to fix them
- 'unsafe-inline' in script-src — how to remove it →
- Report-Only: roll out CSP without breaking the site →
- CSP is blocking my site — fix it without disabling CSP →
- script-src, default-src and the fallback chain →
- frame-ancestors and clickjacking →
New to SSL/TLS errors? Start with the complete guide to SSL/TLS errors →
Frequently asked questions
Is this CSP checker free?
Yes — free and open, no account or email. Check a URL or paste a policy and get the result immediately.
Is this the same as Google's CSP Evaluator?
It checks the same class of weaknesses (unsafe-inline, wildcards, missing object-src and base-uri, strict-dynamic misuse). On top of that it explains each finding in plain English for the site owner, links every finding to a fix guide, resolves fallbacks the way a browser does, and hands back your policy with the missing hardening directives appended.
Why did I get an F?
An F means no enforcing Content-Security-Policy was delivered on the homepage. A report-only policy alone scores C because it measures but blocks nothing. Start with the starter policy in the fix guide, in Report-Only mode.
Does the URL mode do anything intrusive?
No. It performs one normal GET of your homepage and reads the headers and <meta> tags any browser receives. It never executes JavaScript or crawls other pages, so resources loaded dynamically are not visible to it.
Does a good CSP grade mean my site is secure?
No — it means one important header is configured well. CSP limits the damage of injection bugs; it does not find them. Use the Website Security Score and the other checkers for the rest of the external surface.