Evaluate a Content-Security-Policy before attackers do
A Content-Security-Policy is one of the strongest defences against cross-site scripting — but only when it is written correctly, and most real-world policies are not. This CSP evaluator parses your policy directive by directive and ranks every weakness: 'unsafe-inline' and 'unsafe-eval' in scripts, wildcard and scheme sources such as *, https: and data:, plain-HTTP sources, CDN and Google hosts that are known to allow bypasses, and missing object-src, base-uri, frame-ancestors, form-action and default-src.
It also catches the mistakes that silently disable a policy: unquoted keywords (self instead of 'self'), a missing semicolon that turns the next directive into a source, misspelt or duplicate directives, unquoted nonces, 'strict-dynamic' without a nonce, directives that do nothing in a <meta> tag, report-only delivery and deprecated directives. Each finding explains the risk and the fix, and the tool proposes a hardened, nonce-based policy you can copy as a header, an nginx or Apache line or a meta tag.
The policy is analysed in your browser; nothing is fetched or uploaded.
How to use the CSP Evaluator
- Copy the policy from your server configuration, or from DevTools → Network → the page request → Response headers →
Content-Security-Policy. - Paste it into the box. A full header line or a
<meta http-equiv>tag works too; the delivery method is detected automatically. - Read the score and the Findings, sorted from high to info severity, each with the affected directive and a fix.
- Check Parsed directives to confirm the browser reads the policy the way you intended.
- Copy the Suggested hardened policy in the format you need, generate a fresh nonce per response, and test it as
Content-Security-Policy-Report-Onlybefore enforcing.
CSP Evaluator features
Severity-ranked findings
High, medium, low and info levels modelled on Google’s published CSP research, so the issues that let an injected script run come first.
Bypass-aware
Flags allowlisted hosts — Google APIs, public CDNs, cloud storage — where JSONP endpoints or outdated libraries let attackers satisfy a host allowlist.
Syntax mistakes caught
Unquoted keywords and nonces, missing semicolons, unknown or misspelt directives, duplicates and 'none' mixed with other sources.
Delivery-aware
Recognises header, report-only and meta-tag policies and warns about directives that meta tags ignore (frame-ancestors, report-uri, report-to, sandbox).
Hardened policy generator
Rewrites scripts as 'nonce-{NONCE}' 'strict-dynamic' with backward-compatible fallbacks, adds the missing protective directives, removes deprecated ones and lists every change.
What a strict CSP looks like
Host allowlists are hard to get right, so current guidance (W3C CSP Level 3, web.dev “Mitigate XSS with a strict CSP”) recommends nonces or hashes plus 'strict-dynamic':
script-src 'nonce-{random}' 'strict-dynamic' https: 'unsafe-inline'— modern browsers trust only nonced scripts and what they load;https:and'unsafe-inline'are ignored by them and exist only for very old browsers.object-src 'none'— disables plugins, an old script-execution path.base-uri 'none'or'self'— stops injected<base>tags from hijacking relative URLs.frame-ancestors 'self'— prevents clickjacking (header only).- A new, unpredictable nonce of at least 128 bits on every response, added to each
<script nonce="…">tag. Inline event handlers (onclick=) must move into scripts.
Severity guide
| Severity | Meaning | Examples |
|---|---|---|
| High | An attacker who can inject HTML can probably run script | 'unsafe-inline' without nonces, * or data: in script-src, missing object-src, unquoted keywords |
| Medium | Protection can be bypassed or a related attack is open | 'unsafe-eval', bypassable CDN hosts, missing base-uri or frame-ancestors, missing default-src |
| Low | Hardening gaps with limited impact | Missing form-action, inline styles, short nonces, deprecated block-all-mixed-content |
| Info | Notes and optional improvements | Report-only mode, reporting endpoints, Trusted Types, upgrade-insecure-requests |
Rolling out the hardened policy safely
Send the new policy as Content-Security-Policy-Report-Only first, with a report-to endpoint, and watch the reports for a few days: third-party widgets, inline handlers and browser extensions all show up there. When the reports are clean, switch the header name to enforce it. The CSP Generator builds a policy from scratch, the nginx config generator adds it to a server block, and the security header checker verifies what a live site sends.
CSP Evaluator FAQ
How do I check my Content-Security-Policy?
Paste the header value into the CSP evaluator. It lists every weakness by severity, shows how the browser parses each directive and suggests a hardened version. To get the header from a live site, copy it from DevTools → Network → Response headers.
Is 'unsafe-inline' always bad?
In script-src without nonces or hashes, yes — it lets injected inline scripts and event handlers run, which defeats CSP’s main purpose. Next to a nonce or hash it is ignored by modern browsers and only acts as a fallback, which is safe. In style-src it is a much smaller risk.
Why is my allowlisted CDN flagged?
Large shared hosts such as ajax.googleapis.com, cdnjs or jsDelivr serve thousands of libraries, including old ones with known script gadgets and JSONP endpoints. If your policy trusts the whole host, an attacker can load one of those instead of your file. Nonces with 'strict-dynamic' avoid the problem.
Does a CSP in a meta tag work?
Mostly. Fetch directives such as script-src work, but frame-ancestors, report-uri, report-to and sandbox are ignored in meta tags, and the policy only applies to content after the tag. Prefer the HTTP header.
What should I do about the {NONCE} placeholder?
Your server must generate a fresh random value (for example 16 bytes from a cryptographic random generator, Base64-encoded) for every response, put it in the header and add nonce="…" to each script tag. Never use a fixed nonce.
Can this tool fetch the CSP from a URL?
No — it analyses the text you paste and makes no requests. Browsers block reading other sites’ headers from a web page, so copy the header from DevTools or use curl -I https://example.com.