FormatterHQ
JSON Tools XML Tools YAML Tools CSV & TSV Tools HTML Tools CSS Tools JavaScript Tools SQL Tools Code Formatters & Beautifiers Minifiers Validators Data Converters Data to Class Generators Escape & Unescape Encode & Decode Base64 Tools Hash & Cryptography String & Text Utilities Number Converters Color Converters Unit Converters IP & Network Tools Random Data Generators Diff & Compare Viewers & Editors Image Tools PDF Tools Markdown Tools SEO & Webmaster Tools Developer Utilities JSON Formatter PDF Tools XML Formatter Beautifiers Converters Blog

Content Security Policy Evaluator

Paste a Content-Security-Policy header or <meta> tag to list its directives and flag weaknesses such as unsafe-inline, broad sources and missing object-src or base-uri.

Input TEXT
Output TEXT
Ready.

How to use the Content Security Policy Evaluator

  1. Paste your policy: the header value, a full Content-Security-Policy: line, or a <meta http-equiv> tag.
  2. Click Evaluate CSP (it also runs as you type).
  3. Review the Directives table to confirm the policy was parsed as you expect.
  4. Work through the Findings from HIGH and MEDIUM down to WARN and INFO, update your policy and evaluate again.

CSP evaluator for Content-Security-Policy headers

This CSP evaluator parses a Content-Security-Policy and points out the settings that weaken it. A CSP is only as strong as its loosest directive, and small mistakes, like an unquoted keyword or a trusted CDN, can quietly turn it into a policy that blocks nothing an attacker cares about. The tool lists every directive it found, then ranks findings by severity so you know what to fix first.

What is a Content Security Policy?

A CSP is an HTTP response header (or a <meta> tag) that tells the browser which sources of scripts, styles, images, frames and connections a page may use. Its main purpose is to limit the damage of cross-site scripting (XSS): even if an attacker injects markup, the browser refuses to run scripts that the policy does not allow. It also controls framing, form targets and mixed content.

Example

The sample policy looks reasonable at first glance:

default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src * data:; connect-src 'self' https://api.example.com; report-uri /csp-report

The evaluator's findings tell a different story:

✘ HIGH    script-src allows 'unsafe-inline' — inline <script> and event handlers run, which defeats most XSS protection.
! MEDIUM  script-src trusts a public CDN; known JSONP/Angular gadgets on such hosts can bypass the policy. Prefer nonces + 'strict-dynamic'.
! MEDIUM  object-src is not 'none' — plugins (<object>, <embed>) could execute script. Add object-src 'none'.
! MEDIUM  base-uri is missing — an injected <base> tag can hijack relative script URLs. Add base-uri 'self' or 'none'.
• INFO    frame-ancestors is missing — the page can be framed (clickjacking) unless X-Frame-Options is set.
• INFO    form-action is missing — injected forms could post data to other origins.

Because 'unsafe-inline' is present without a nonce or hash, an injected <script> tag or onerror attribute would simply run. Additional INFO lines cover the inline styles and the deprecated report-uri.

What the evaluator checks

  • Script sources – 'unsafe-inline' without a nonce or hash, 'unsafe-eval', broad sources like *, https:, data: and blob:, wildcard subdomains, and public CDNs that host bypass gadgets.
  • Fallbacks – when script-src is absent, default-src is used, just as the browser does. With neither, the policy offers no script protection.
  • Nonce and strict-dynamic – a nonce or hash combined with 'strict-dynamic' is reported as the recommended strict CSP; 'strict-dynamic' without a nonce is flagged because it blocks every script. A nonce shorter than 8 characters gets a warning, and any nonce brings a reminder that it must be random and new for every response.
  • Hardening directives – missing object-src 'none', base-uri, frame-ancestors and form-action.
  • Broad sources elsewhere – * or https: in a directive other than the script one, such as connect-src, frame-src, base-uri or form-action, is listed as INFO because it restricts very little. img-src, media-src and font-src are left out of this check.
  • Syntax mistakes – unquoted keywords (self instead of 'self' is treated as a host name), duplicate directives (only the first counts), unknown directive names, 'none' mixed with other sources, and http: sources.
  • Reporting – no reporting endpoint, or report-uri without the newer report-to.

Fixing common findings

The most robust modern pattern is a nonce-based strict policy:

script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none'

Your server generates a fresh random nonce for every response and adds it to each legitimate <script> tag. Scripts those trusted scripts load are allowed through 'strict-dynamic', so you do not need to maintain host allowlists. For static sites, use 'sha256-…' hash sources instead. They hold the Base64 SHA-256 digest of the exact inline script, the same format the SRI hash generator prints when set to SHA-256, so you can paste the script body there and copy the value. The same tool gives third-party files an integrity attribute.

A CSP is defense in depth, not a replacement for output encoding. Keep escaping user data with tools like HTML escape so injection does not happen in the first place.

Report-only mode

You can paste a Content-Security-Policy-Report-Only header too. Deploying a new policy in report-only mode first lets you collect violations from real traffic without breaking pages, then switch to enforcement once reports are clean.

Privacy

The policy is parsed and evaluated entirely in your browser. Nothing is fetched from your site and nothing you paste is uploaded.

Frequently asked questions

Why is unsafe-inline in script-src so dangerous?
It allows any inline script block and inline event handler to run, which is exactly what most XSS payloads use. With it present and no nonce or hash, the policy barely limits script injection.
Is a CSP meta tag as good as the HTTP header?
A meta tag enforces most directives, but frame-ancestors, report-uri and sandbox are ignored when delivered that way, and it only applies to content after the tag. Prefer the response header when you control the server.
Why is trusting a CDN like cdnjs flagged?
Large public CDNs host thousands of libraries, some of which contain script gadgets such as old AngularJS versions or JSONP endpoints. An attacker who can inject HTML can load one of those files from your allowed host and execute code. Nonces with strict-dynamic avoid this.
Does this tool fetch the CSP from my website?
No. Paste the policy you want to evaluate. You can copy it from your browser DevTools Network tab under the response headers of the page.
What does strict-dynamic do?
It tells the browser to trust scripts loaded by already-trusted scripts, which were approved by a nonce or hash. Host allowlists and unsafe-inline are then ignored by browsers that support it, making the policy both stricter and easier to maintain.

Last updated October 3, 2026

Guides

How to Check a Content Security Policy with a CSP Evaluator Read a Content Security Policy directive by directive, fix the weaknesses a CSP evaluator reports, and roll out a strict nonce-based policy in report-only mode first. Subresource Integrity (SRI) Hashes: A Practical Guide How Subresource Integrity stops a modified CDN file from running, how integrity values are built and verified, and how to handle upgrades, mismatches and files that change.

Related tools

cURL to Axios (Node.js) Converter Convert curl commands to Node.js axios requests with params, headers, JSON data, auth, form-data uploads and timeouts. cURL to C# Converter Convert curl commands to C# HttpClient code for .NET with headers, content types, basic auth, multipart and TLS options. cURL to Go Converter Convert curl commands into Go code using net/http — method, headers, JSON or form body, basic auth, timeouts and multipart uploads. cURL to PHP Guzzle Converter Convert curl commands to PHP Guzzle requests using json, form_params, multipart, query and auth options. cURL to Java Converter Convert curl commands to Java 11+ java.net.http.HttpClient code with headers, body, redirects and timeouts. cURL to JavaScript Fetch Convert curl commands into JavaScript fetch() code with method, headers, JSON body, form data, basic auth and timeouts. cURL to PHP Converter Convert curl commands into PHP code using the curl_* functions: method, headers, body, auth, cookies and SSL options. cURL to Python Requests Convert curl commands into Python requests code: headers, params, JSON or form data, files, cookies, auth and timeouts. cURL to Rust Converter Convert curl commands to Rust using the reqwest crate, with JSON bodies via serde_json, headers, auth and timeouts. Date & Time Calculator Calculate the difference between two dates or add/subtract days, weeks, months and years from a date. Docker Run to Docker Compose Convert one or more docker run commands into a docker-compose.yml: ports, volumes, env, restart, networks, healthchecks and more. File Type Checker Find out what a file really is from its content, not its name. Detects 150+ formats and warns when the extension does not match.