Content Security Policy (CSP) Evaluator
Grade and build a Content-Security-Policy.
{RANDOM} with a new random value (16 bytes or more, base64) on every response, and add the same value to each script tag: <script nonce="…">. 'strict-dynamic' lets those scripts load others; https: and 'unsafe-inline' next to it are ignored by modern browsers and only help very old ones. Try a new policy as Report-Only before enforcing it.About the CSP Evaluator
A Content-Security-Policy tells the browser where a page may load scripts, styles, frames and other resources from, so injected markup can't run code. This evaluator reads a policy and reports what weakens it, in the spirit of Google's CSP Evaluator. Each finding has a severity: high (scripts can be injected or the policy bypassed), medium, low or info.
Give it a URL and it reads every Content-Security-Policy and Content-Security-Policy-Report-Only header after redirects, plus any <meta http-equiv> policy in the HTML. Or paste a policy, a full header line or a meta tag. It checks 'unsafe-inline', 'unsafe-eval', wildcards and https: in script-src, hosts such as cdn.jsdelivr.net that serve anyone's code, 'strict-dynamic' with nonces and hashes, missing object-src, base-uri and frame-ancestors, typos, deprecated directives and Report-Only mode.
How to use it
- Choose Check a URL or Paste a policy and select Evaluate.
- Work through the high and medium findings first; each one says what to change.
- Use Build a policy to assemble a new policy from presets and evaluate it before you deploy it.
Examples
- Evaluate github.com: a large allowlist-based policy.
- Evaluate a strict nonce policy: the pattern Google recommends.
- Evaluate a weak policy: inline scripts and any HTTPS host are allowed.
Common questions
Why is 'unsafe-inline' only "info" in my policy?
When a policy has a nonce or hash, browsers ignore 'unsafe-inline' in that directive. It's kept only as a fallback for very old browsers.
What happens with several policies?
Browsers enforce all of them. A resource must pass every policy, so adding one can only make things stricter.
Should I start with Report-Only?
Yes. Report-Only blocks nothing, so you can collect violation reports, fix them and then enforce the same policy.
Related tools
- Security Headers Checker: grade CSP alongside the other security headers.
- Cookie Security Checker: check the cookies the same page sets.
- HTTP Request Builder: see every response header a URL sends.