CSP Evaluator
Options
Findings
Normalized directives
What is a CSP Evaluator?
A CSP Evaluator reviews a Content-Security-Policy header and highlights directives that may weaken browser-side protection.
It is useful when tuning XSS defenses, reviewing application headers, comparing policies, or preparing a stricter production CSP.
How to use the CSP Evaluator
- Paste a Content-Security-Policy header into the input field.
- Click Evaluate CSP or enable automatic evaluation.
- Review critical findings, warnings, passed checks, and the normalized directive list.
- Adjust your server configuration and test again.
Related guides
Learn the workflow behind this tool and what to check next.
How to review security headers, CSP, and HSTS
A rollout workflow for understanding which layer sets each header, testing real browser behavior, and avoiding lockouts or false confidence.
Domain launch validation checklist
A layered domain launch check that catches DNS, certificate, routing, mail, and SEO mistakes before users find them.
CSP checks before deploying a stricter security policy
A Content Security Policy can reduce XSS risk, but unsafe directives, missing fallbacks, report-only testing, and third-party scripts need careful review.
Remove unsafe script rules
Review unsafe-inline, unsafe-eval, wildcards, data sources, and broad HTTPS allowances before treating a policy as strong.
Set critical directives
Check default-src, script-src, object-src, base-uri, frame-ancestors, and form-action for the protections your app needs.
Use report-only rollout
Test policy changes with Content-Security-Policy-Report-Only before enforcing them on production traffic.
Track third-party dependencies
Document analytics, ads, chat, CDN, and payment domains so future vendors do not weaken the policy by accident.
Related tools
You may also find these tools useful.