intext

CSP Analyzer Online

Home › Security › CSP Analyzer

Parse Content-Security-Policy headers, detect security issues, generate recommended configs Web SecurityZero Dependencies

📝 Enter CSP Policy

📊 Analysis Results

Enter a CSP policy and click Analyze

Security Score

--

Awaiting analysis

What is Content-Security-Policy?

Content-Security-Policy (CSP) is one of the most important security mechanisms for modern web applications. It uses an HTTP header to tell the browser which resources are allowed to load, effectively preventing cross-site scripting (XSS), clickjacking, data injection, and other security threats.

CSP Best Practices

Common CSP Security Issues

A misconfigured CSP may be ineffective: 'unsafe-inline' defeats XSS protection; wildcards (*) allow any source; missing default-src leaves unspecified directives unrestricted; data: URIs can be exploited for malicious code injection.

What is Content-Security-Policy?
CSP is an HTTP security header that controls which resources the browser can load, preventing XSS and data injection attacks.
What risks do 'unsafe-inline' and 'unsafe-eval' pose?
'unsafe-inline' allows inline scripts/styles, defeating XSS protection. 'unsafe-eval' allows eval() and dynamic execution, similarly weakening security. Avoid both in production.
How to switch from report-only to enforcement?
Test with Content-Security-Policy-Report-Only first (reports only, no blocking), then switch to Content-Security-Policy for enforcement.
Is my data uploaded?
No. All analysis runs locally in your browser. No data is uploaded.

🔗 Related Tools

Docker Compose ValidatorFile Type DetectorGoogle Index Checker