Browser tool

Content Security Policy evaluator

Parses a Content-Security-Policy header, shows every directive and flags weak script rules, a missing object-src, base-uri or frame-ancestors, and Report-Only policies that enforce nothing.

Runs locallyEverything you enter stays on this page. Nothing is uploaded or stored.

Content-Security-Policy header (the value, or the whole line)

Method and limits

Paste the header value, or the whole line with the header name. Copy it from the browser's developer tools (Network tab) or from a request you made to your own site. The tool never requests a site.
The script policy is script-src, or default-src when script-src is absent. The tool judges that policy, plus object-src, base-uri and frame-ancestors, which do not fall back to default-src. Other directives are listed but not judged, and script-src-elem and script-src-attr are not evaluated separately.
A policy that passes these checks is not a complete defence. The tool cannot tell whether a nonce changes with every response, whether an allowed host serves content an attacker can influence, or how older browsers treat the policy. Try a new policy as Report-Only first and read the reports.

Sources

Related tools

HTTP security header audit →

Workspace