CSP Evaluator
Paste a Content-Security-Policy header and see which script source actually applies after the default-src fallback, where unsafe-inline or unsafe-eval still take effect, which wildcard or scheme sources allow any host, which directives have no fallback at all, and a suggested policy that explains every change. Runs entirely in your browser.
Loading tool...
What is CSP Evaluator?
The CSP Evaluator is a static analyser for a Content-Security-Policy that you already have. Paste the header and it reads the directive list the way a browser resolves it — following the default-src fallback for the fetch directives, letting script-src-elem override script-src, and keeping quoted keywords and nonces or hashes distinct from host names — then reports, rule by rule, what the policy leaves open. Every finding carries a severity, an explanation of why it matters and a suggested fix, and the results close with a suggested policy built from your own directives that lists each change it applied and each fix it left as advice. It never sends a request, never observes a real browser, and does not claim a complete catalogue of bypasses: it is a documented rule set, and a policy with no findings has not been proven safe.
Key Benefits
- Turns a header that looks fine into an explicit list of what it leaves open, so a policy that reads as protected is not mistaken for one that is.
- Makes the default-src fallback chain visible, which is where a missing script-src quietly hides the real script rules.
- Explains why a wildcard is still worth removing when strict-dynamic makes it inert in current browsers, because the fallback path still honours it.
- Keeps the directives that do not inherit from default-src in front of you instead of letting a strict default-src imply coverage it does not provide.
- Ends with a policy you can paste, and names the changes that could break inline scripts so you can test rather than deploy blind.
Common Use Cases
- •Reviewing a Content-Security-Policy before tightening it, to see what the current policy already allows.
- •Checking a policy that came from a template or from another generator, where the directive list may not match what the application actually needs.
- •Understanding why a report-only rollout still produces violations, by finding the directive that does less than its name suggests.
- •Teaching the fallback chain and the strict-dynamic interaction with a real header and immediate, rule-by-rule feedback.
- •Documenting what a policy does and does not cover for a change review or a security questionnaire.
How to Evaluate a Content-Security-Policy Header
- Paste the policy: Paste the Content-Security-Policy value from your response headers, with or without the header name, or load one of the built-in examples. Several lines and mixed casing are both fine.
- Check what is actually in force: The effective script source block shows which directive governs script elements and inline event handlers, and whether it was inherited from default-src instead of being written explicitly.
- Work through the findings: Each row gives the severity, the directive it concerns and the reason it matters. Fixes that would change behaviour are listed as advice, so you can judge them against your own application.
- Take the suggested policy: Copy the suggested policy and the change list, review both against your application, then deploy and verify in report-only mode before enforcing. This is a review aid, not a substitute for testing your site.
Key Features
- Identifies the script source that is really in force, including the case where script-src is missing and default-src is quietly doing the work.
- Explains the strict-dynamic interaction correctly: unsafe-inline and scheme sources are inert only when a nonce or hash activates it, and they remain effective as a fallback for older implementations.
- Scores wildcard and scheme sources by how much script execution each one leaves open instead of treating every wildcard as the same finding.
- Separates the directives that have no fallback at all — base-uri, frame-ancestors, form-action and sandbox — from the ones that inherit from default-src.
- Returns a suggested policy built from your own directives, with each change explained and every behaviour-changing fix left as advice rather than applied silently.
- Reports deprecated and never-implemented directives as information rather than errors, and states its own limits inside the report.