Content Security Policy inspector
This tool reads a Content Security Policy (CSP), the HTTP header that tells browsers which scripts, styles, images and other resources a page may load. It lays out each directive and its sources and points out common weak spots. It only parses the text you paste and does not test or certify any website.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; base-uri 'self'
PARSE VIEW ONLY. This is not a security test or a guarantee that a policy is safe.
{
"reportOnly": false,
"directives": [
{
"name": "default-src",
"values": [
"'self'"
],
"applied": true,
"recognized": true
},
{
"name": "script-src",
"values": [
"'self'",
"https://cdn.example.com"
],
"applied": true,
"recognized": true
},
{
"name": "object-src",
"values": [
"'none'"
],
"applied": true,
"recognized": true
},
{
"name": "base-uri",
"values": [
"'self'"
],
"applied": true,
"recognized": true
}
],
"notes": [
"No frame-ancestors directive is present. default-src does not supply that restriction."
]
}How to use the content security policy inspector
- Paste one policy into the One Content-Security-Policy or Report-Only policy box. The header name in front is optional.
- Keep the policy on a single line.
- Press Run. This tool has no settings to change.
- Review the directives and notes, then Copy result or Download.
How it works
Each directive is listed with its source tokens, whether it is applied, and whether it is a recognized CSP directive name.
If a directive appears twice, only the first is marked as applied, matching how browsers treat duplicates.
Notes flag 'unsafe-inline', 'unsafe-eval', *, data: and http: sources, and point out a missing default-src or frame-ancestors directive.
A Content-Security-Policy-Report-Only header is noted as reporting violations without enforcing them.
Line breaks and commas are rejected because they signal more than one policy. The result is a parse view only, not a security test or a guarantee that the policy is safe.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
Does this tell me if my site is secure?
No. It parses one policy you paste. It does not load your site, run the policy or check how it works with your pages, so treat the notes as starting points for a review.
Why does it flag a missing frame-ancestors directive?
frame-ancestors controls which sites may show your page inside a frame. default-src does not cover it, so without it the policy places no limit on framing.
Why are commas rejected?
A comma joins separate policies in one header, and browsers apply each one separately. This tool reads one policy at a time, so split them and inspect each.
Is my policy sent anywhere?
No. Parsing runs in your browser, and the tool never contacts the site the policy belongs to.