CSP Header Analyzer
Parse an existing Content-Security-Policy and flag wildcard, unsafe, insecure, duplicate, and missing controls
Policy findings will appear here.
About this tool
CSP Header Analyzer parses an existing Content-Security-Policy or Report-Only header into directive and source lists, then applies a focused static rule set. It flags duplicate directives, global wildcards, unsafe-eval, unsafe-inline, HTTP sources, data: script sources, none mixed with other sources, missing default-src, object-src that is not none, and missing base-uri or frame-ancestors guidance. Findings are sorted by high, medium, and low severity, while unknown directive names remain visible for manual spelling and browser-support review. This is not a browser CSP evaluator: inheritance between directives, nonce and hash validity, strict-dynamic behavior, redirects, report delivery, application routes, and runtime violations require testing in Report-Only mode and real browsers.
Scenario Recipes
Prepare a CSP tightening change with Report-Only evidence
Goal: Use static findings as a review input rather than a security verdict
- Analyze the current enforced policy and classify every high or medium finding by application dependency.
- Draft the narrower policy with the CSP generator and deploy it as Report-Only to representative routes.
- Review browser violation reports, fix required sources, test authentication and payment flows, then enforce through normal change control.
Result: A CSP change backed by static review, runtime evidence, and route-level testing.
Frequently Asked Questions
What risks does the analyzer flag?
It covers common wildcard, unsafe keyword, insecure HTTP, data script, duplicate, none-mixed, and missing-baseline patterns.
Does it prove a CSP is secure?
No. Static text rules cannot model application behavior, browser inheritance, endpoint trust, or runtime violations.
Are Report-Only headers supported?
Yes. The prefix is accepted, but report delivery and violation events are not executed.
Why are unknown directives shown?
They may be misspelled, experimental, obsolete, or newer than the analyzer allowlist and need manual browser-support review.
How should I roll out a stricter CSP?
Start with Report-Only, collect real violations, remove dependencies deliberately, test critical routes, then enforce.
Is the policy uploaded?
No. Tokenization, findings, sorting, and tables are produced locally.
Keep browsing