CSP Analyzer Online
Parse Content-Security-Policy headers, detect security issues, generate recommended configs Web SecurityZero Dependencies
📝 Enter CSP Policy
📊 Analysis Results
Enter a CSP policy and click Analyze
Security Score
--
Awaiting analysis
What is Content-Security-Policy?
Content-Security-Policy (CSP) is one of the most important security mechanisms for modern web applications. It uses an HTTP header to tell the browser which resources are allowed to load, effectively preventing cross-site scripting (XSS), clickjacking, data injection, and other security threats.
CSP Best Practices
- Always set default-src as a fallback policy
- Avoid 'unsafe-inline' and 'unsafe-eval'
- Use nonce or hash instead of 'unsafe-inline'
- Set upgrade-insecure-requests to enforce HTTPS
- Use Report-Only mode for testing before enforcement
- Set frame-ancestors to prevent clickjacking
Common CSP Security Issues
A misconfigured CSP may be ineffective: 'unsafe-inline' defeats XSS protection; wildcards (*) allow any source; missing default-src leaves unspecified directives unrestricted; data: URIs can be exploited for malicious code injection.
What is Content-Security-Policy?
CSP is an HTTP security header that controls which resources the browser can load, preventing XSS and data injection attacks.
What risks do 'unsafe-inline' and 'unsafe-eval' pose?
'unsafe-inline' allows inline scripts/styles, defeating XSS protection. 'unsafe-eval' allows eval() and dynamic execution, similarly weakening security. Avoid both in production.
How to switch from report-only to enforcement?
Test with Content-Security-Policy-Report-Only first (reports only, no blocking), then switch to Content-Security-Policy for enforcement.
Is my data uploaded?
No. All analysis runs locally in your browser. No data is uploaded.