0
Not analyzed
Run the checker to evaluate the policy.
CSP Checker
Analyze a Content-Security-Policy header, identify risky directives, and generate practical recommendations for a stronger policy.
Paste a CSP header or check a website URL to start the analysis.
Directives
0
defined directives
Strong Controls
0
recommended protections
Warnings
0
items to review
High-Risk Issues
0
important weaknesses
script-src
—
script execution control
frame-ancestors
—
clickjacking protection
object-src
—
plugin content control
Unsafe Keywords
0
'unsafe-inline' / 'unsafe-eval'
🧱 Directive Analysis
🔎 Security Findings
💡 Recommended Improvements
🧾 Normalized Policy
🌐 Source Information
Analysis Source
Manual Policy
Pasted CSP header
Header Type
Enforced
Content-Security-Policy
HOW IT WORKS
Manual Analysis, or a Real Header Fetch
Pasting a policy runs the entire analysis in your browser - directive parsing, scoring, findings and recommendations - with nothing sent to our server. Checking a live website URL is different: browsers can't read another site's response headers cross-origin because of CORS, so that mode calls our own backend, which validates the URL, blocks private/loopback/link-local/cloud-metadata addresses, follows a limited number of redirects, and reads only the Content-Security-Policy and Content-Security-Policy-Report-Only response headers - the response body is never downloaded.
CSP Checker FAQ
Does pasting a policy send it to your server?
No. Manual policy analysis - parsing, scoring, findings, recommendations - runs entirely in your browser's JavaScript. Nothing is uploaded.
Why does "Check Website URL" need a backend?
Browser JavaScript can't read another origin's response headers due to the same-origin policy and CORS, so fetching a target site's real CSP headers has to happen server-side.
Can I check an internal or private URL?
No. Hostnames that resolve to localhost, private IP ranges, link-local addresses or cloud metadata endpoints are rejected before any request is made, and each redirect hop is re-validated the same way.
What if a site only sends Content-Security-Policy-Report-Only?
It's still fetched and shown, labeled "Report Only" - that header reports violations without blocking anything, so it's a weaker signal than an enforced policy.
How is the score calculated?
It starts at 100 and deducts points for missing or weak directives (no default-src, no script-src restriction, unsafe-inline/unsafe-eval, wildcard sources, missing frame-ancestors, and more) - the same checks listed under Security Findings.