Free tools
CSP Evaluator
Paste a Content-Security-Policy header, a meta tag or the bare policy value. Each directive is parsed, and each weakness comes with why it matters and how to fix it.
No network. Nothing you enter leaves this tab. The policy is parsed in your browser.
Results
Parsed directives and findings appear here.
Reading the results
- 'unsafe-inline' in script-src
- Inline script and event handlers run, so any HTML injection on the page becomes script execution. This is the finding that matters most. Nonces with strict-dynamic are the usual way out.
- 'unsafe-eval'
- eval and new Function work, which turns DOM injection bugs into code execution. It is often there for one old library.
- Wildcards and scheme sources
- script-src * or https: allows script from any host, so the attacker just hosts their own. data: lets the script travel inside the URL. For images and fonts a wildcard is usually fine, and the tool rates it that way.
- Plain http sources
- Anything loaded over http can be swapped on the network path. Use https and add upgrade-insecure-requests.
- Missing object-src
- Without it, plugins fall back to default-src. object-src 'none' costs nothing on a modern site.
- Missing base-uri or frame-ancestors
- Neither falls back to default-src, so default-src 'self' does not cover them. A missing base-uri lets an injected base tag repoint relative script URLs; a missing frame-ancestors allows clickjacking unless X-Frame-Options is set.
- Report-only versus enforced
- Content-Security-Policy-Report-Only blocks nothing. It is the right way to roll a policy out and the wrong place to leave it.
- Public CDN hosts in script-src
- Allowing a whole CDN allows every file on it, including old AngularJS builds and JSONP endpoints that run attacker-chosen code while staying inside the policy.
A clean result means the policy has none of the common gaps. It does not mean the site has no injection bugs, and some attacks (data exfiltration through WebRTC, for one) go around CSP entirely.