CSP Checker
Paste a Content-Security-Policy header and check its directives for risky values.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
CSP Checker
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
Pasting a policy with 'unsafe-inline' in script-src flags that value and counts the directives.
What this tool does not do / Limits
This tool only analyses a policy you paste here. It does not fetch, test or verify any live site or policy.
Frequently asked questions
Does this prove my site is secure?
No. It only flags common risky values in pasted text; a full review still needs testing of the real policy.
Does it check a live site?
No. It only reads the policy you paste, and it never contacts any site.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live