CSP Evaluator
Paste the header value (or the whole header line) to find directives that let attackers back in, missing protections, typing mistakes and what is already done well.
About CSP Evaluator
Having a Content-Security-Policy header is not the same as having a useful one. A policy that allows unsafe-inline scripts, a wildcard or a bare https: scheme looks like protection but lets most attacks straight through. The CSP evaluator reads a policy the way a browser does and flags the weaknesses that matter, so you can tell a policy that works from one that only looks the part.
Paste the value of the header, or the whole header line. The evaluator checks where scripts may come from, whether inline code and eval are allowed, whether wildcards and schemes are too broad, whether plug-ins, the base address, forms and framing are controlled, and whether anything is listed twice, misspelled or missing its single quotes. Each finding has a severity and an explanation, a grade sums up the result, and a list of what is already good shows what to keep.
How to use CSP Evaluator
- Copy the Content-Security-Policy value from your site's response headers or your server settings.
- Paste it into the box. The checks run as you type.
- Start with the high items, which are the ones that let injected scripts run.
- Change the policy, paste it again and watch the grade and findings update.
Common uses
- Reviewing a policy that a developer or a plug-in added
- Checking a policy before a security audit
- Finding the typing mistake that stops a directive working
- Comparing a report-only policy with the one you plan to enforce
Frequently asked questions
Why is unsafe-inline marked as serious?
It allows any inline script, including one an attacker has injected, to run. That removes most of the protection against cross-site scripting. If the policy also has a nonce or hash, current browsers ignore unsafe-inline, and the evaluator shows it as a note instead.
What does a missing single quote do?
Words such as self, none and unsafe-inline must be in single quotes. Without them the browser reads the word as a host name, so script-src self allows a host called self and not your own site. The evaluator flags every case it finds.
Does a good grade mean my site is protected?
It means the policy text avoids the common weaknesses. It cannot see which pages send the policy or whether your site still works under it, and some attacks need other defences. Treat the grade as a guide and test the real site.
Why does it complain about base-uri and form-action?
These directives do not fall back to default-src, so leaving them out leaves a gap. Without base-uri an injected base tag can redirect relative script addresses, and without form-action an injected form can send data to another site.
Can I check a report-only policy?
Yes. The directives are the same. Paste the value, or the whole line with Content-Security-Policy-Report-Only at the start.