All tools

CSP Evaluator & Builder

Audit Content-Security-Policy headers for unsafe-inline/eval/wildcards, or build a clean CSP string.

Network & APIs
Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Paste a Content-Security-Policy header to flag dangerous directives, or build a cleaner policy with visual toggles.

Score30/1005 directives
  • critical · script-src

    'unsafe-inline' on script-src weakens XSS protections

  • warn · script-src

    Wildcard * on script-src allows any origin

  • critical · style-src

    'unsafe-inline' on style-src weakens XSS protections

  • warn · img-src

    Wildcard * on img-src allows any origin

  • info · img-src

    Permissive token data: on img-src

  • info · frame-ancestors

    No frame-ancestors — page may be embedded by any origin (clickjacking)

What does a CSP do?

Content-Security-Policy tells browsers which scripts, styles, images, and frames a page may load. Misconfigured policies with 'unsafe-inline', 'unsafe-eval', or * wildcards re-open XSS paths.

Paste a header to score risky directives, or build a cleaner policy string with per-directive controls.

How to use this tool

  1. Evaluate: paste your CSP header and review critical/warn findings.
  2. Builder: toggle directives and copy the assembled header value.
  3. Deploy via Content-Security-Policy HTTP header or meta http-equiv (header preferred).

Frequently asked questions

Is this a full CSP validator?

It highlights common dangerous tokens and missing hardening directives. Always test policies in staging browsers — report-only mode helps.