Content-Security-Policy (CSP) Evaluator
A Content-Security-Policy is your primary defense against XSS — but a single weak
directive like script-src 'unsafe-inline' can render the entire policy
useless. Paste your CSP header and get a graded analysis of every bypass, weak source,
and missing protection.
Tool interface
Policy Analysis
Directive Scorecard
| Directive | Sources | Status |
|---|
Findings
Introduction
Content Security Policy is the most powerful browser-side defense against cross-site scripting, but it's also one of the easiest to misconfigure. This evaluator applies a rule engine of known bypass techniques to your policy and tells you exactly where you're exposed.
How It Works
- The policy string is tokenized into directives and source lists.
- Each directive is checked against known XSS-bypass patterns.
- CSP Level 3 nonce/hash neutralization of
'unsafe-inline'is applied. - Missing hardening directives (
object-src,base-uri,frame-ancestors) are flagged. - Findings are weighted into a 0–100 security score with a letter grade.
Privacy
Your policy is parsed entirely in your browser. No content is transmitted anywhere. No API calls, no tracking.
Limitations
- Evaluates the static policy string; cannot test against a live DOM or detect runtime-injected violations.
- Does not verify that allowlisted domains are themselves secure (e.g., a compromised CDN).
- JSONP-endpoint bypass detection on allowlisted domains requires live analysis.
FAQ
Is 'unsafe-inline' ever safe?
Only when paired with a nonce or hash source. CSP Level 3 browsers ignore 'unsafe-inline' for scripts if a nonce/hash is present. Otherwise, it allows any inline script to run — defeating XSS protection.
Why do I need base-uri?
Without base-uri, an attacker who injects a <base> tag can change the base URL for all relative links and scripts, redirecting them to a malicious origin.
Is my policy uploaded?
No. Everything is parsed locally in your browser. Nothing is transmitted.