CSP Evaluator
Audit your Content Security Policy. Flags unsafe-inline, unsafe-eval, wildcard sources, missing frame-ancestors, and other common misconfigurations. Paste a CSP or fetch from URL.
Frequently Asked Questions
What does this CSP evaluator check?
It parses every directive and flags: unsafe-inline in script-src, unsafe-eval, wildcard (*) or overly-permissive sources (data:, https:), missing object-src, missing frame-ancestors, and missing base-uri.
What's a good CSP grade?
A: strict CSP with nonces, no unsafe-* directives, frame-ancestors and object-src locked down. B: mostly strict with minor gaps. C: specific allowlists but no unsafe-inline. D: contains unsafe-inline or unsafe-eval. F: wildcard script-src. Aim for B or better.
Why is unsafe-inline such a big deal?
It permits exactly what XSS attackers inject. A CSP with unsafe-inline provides zero XSS protection. The fix is nonce-based CSP (per-response random value) or hash-based CSP. Both block injected scripts while allowing legitimate ones.
Why does my CSP need frame-ancestors?
It controls who can embed your site in an iframe. Without it, attackers can iframe your page for clickjacking. Set frame-ancestors 'none' (no framing) or 'self' (own domain only). frame-ancestors is NOT inherited from default-src.
What's the difference between CSP and CSP-Report-Only?
Report-Only logs violations to the browser console but doesn't block anything — useful for testing. Deploy Report-Only first, collect reports for a week, fix legitimate breakage, then switch to enforcing CSP.
More Free Tools
View all 13 toolsCheck SSL certificate validity and TLS security
Check SPF, DMARC, and MX records
Test password strength (100% client-side)
Check if your email was exposed in breaches
Your privacy matters. We don't store any data you submit. Learn more