← Back to Tools

🛡️ CSP Analyzer

Analyze a Content-Security-Policy header for dangerous directives and missing protections.

Paste the value of a Content-Security-Policy header (with or without the header name prefix).

📚 How CSP prevents XSS attacks

Content-Security-Policy tells the browser which sources of JavaScript, CSS, images, and other resources are trusted. Any resource from an untrusted origin is blocked before it runs.

Without CSP: A successful XSS injection can load external scripts, steal cookies, capture keystrokes, or redirect users — the browser has no way to know the script is malicious.

With a strict CSP: Even if an attacker injects a <script> tag, the browser won't execute it if it's not from an allowed source or doesn't have a valid nonce.

Best practice: Use nonces (script-src 'nonce-{random}') rather than unsafe-inline. Set object-src 'none' to disable plugins, and base-uri 'self' to prevent base-tag injection.

How to use this tool

  1. 1 Paste your Content-Security-Policy header value into the text area.
  2. 2 Click Analyze.
  3. 3 The tool parses each directive and explains what it allows or blocks.
  4. 4 Review any warnings about overly permissive directives like unsafe-inline or unsafe-eval.

Frequently asked questions

What is a Content Security Policy?
A CSP is an HTTP header that tells the browser which sources of scripts, styles, images, and other resources to load. It is one of the most effective defenses against cross-site scripting attacks.
What does unsafe-inline mean?
It allows inline scripts and styles, which bypasses one of the main XSS protections CSP provides. Avoid it if possible and use nonces or hashes instead.
How do I write a strict CSP?
Start with default-src 'none', then add only the specific sources your site needs. Use the CSP Generator tool on this site to build one interactively.
Will a strict CSP break my site?
It can if your site uses inline scripts or loads resources from unlisted domains. Test in report-only mode first to see what would be blocked without actually blocking it.

You might also like

🛡️ Security Headers Checker Inspect a website's HTTP security headers, understand what each one does, and s… 🍪 Cookie Security Analyzer Paste a Set-Cookie header and check for Secure, HttpOnly, SameSite flags. Get a… 🧱 CSP Generator Build a Content-Security-Policy header interactively — toggle directives, add a… 📄 Security.txt Generator Generate a RFC 9116-compliant security.txt file for your domain — the standard …