Content Security Policy (CSP) Checker

What this CSP checker evaluates

Give it a URL and it fetches the page once, reads the Content-Security-Policy header (falling back to Content-Security-Policy-Report-Only, then a <meta http-equiv="Content-Security-Policy"> tag in the page body), and evaluates whatever it finds directive by directive. You can also paste a policy string directly and skip the fetch entirely — useful for a policy you're still drafting, or one behind a login wall this tool can't reach.

unsafe-inline and unsafe-eval

'unsafe-inline' in script-src (or default-src, which it falls back to) is the single most damaging thing a policy can contain, and we grade it as high severity. It re-permits every inline <script> tag and every onclick-style event handler to run — which is exactly the mechanism most cross-site scripting payloads use. The same keyword in style-src is graded far lower: CSS can't execute script on its own, so the worst case is CSS-based data exfiltration, not code execution. 'unsafe-eval' is a separate, medium-severity problem — it permits eval() and similar constructs, which turns any code path that touches attacker-controlled text into a potential execution primitive.

Wildcards and the data: scheme

A bare * in script-src allows script from any origin on the internet — functionally no different from having no script-src at all — so we grade it high. The same wildcard in a directive like img-src or connect-src is still a real loss of control, but a much smaller one, so it grades medium. data: in script-src is graded high for a less obvious reason: a data: URI can contain an entire script, so an attacker who controls any HTML injection point can run JavaScript through it without needing 'unsafe-inline' at all. The same scheme in img-src, for inline icons or generated thumbnails, is completely normal and graded as informational.

The three directives most generators forget

object-src, base-uri and frame-ancestors don't show up in a lot of hand-written policies, but each closes a specific hole: object-src 'none' blocks legacy <object> and <embed> plugin content that can bypass script-src entirely; base-uri 'self' stops an attacker who can inject a single <base> tag from silently rewriting every relative URL on the page; and frame-ancestors is the modern, CSP-native replacement for X-Frame-Options, controlling who can put your page in an iframe. We flag all three as medium severity when missing.

Delivery matters: header vs. meta tag

A policy delivered through a <meta> tag is not equivalent to one sent as an HTTP header. The CSP spec explicitly disallows frame-ancestors, report-uri, report-to and sandbox inside a <meta> tag, and browsers silently drop them rather than erroring. If we find a meta-delivered policy that sets frame-ancestors, we call that out specifically — the page has no clickjacking protection despite the policy appearing to set one.

What a good policy looks like

Content-Security-Policy: default-src 'self';
  script-src 'self' 'nonce-r4nd0m123';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data:;
  object-src 'none';
  base-uri 'self';
  frame-ancestors 'none';
  report-to csp-endpoint;

Notice the script source uses a nonce instead of 'unsafe-inline' — that's how you allow a handful of specific inline scripts without opening the door to every inline script an attacker might inject. Each response needs a fresh, unguessable nonce value, matched by a nonce="..." attribute on the <script> tags you actually trust.

How the grade is calculated

Every check starts the report at 100 and deducts based on severity — a lot for a high-severity issue like a missing policy or a script wildcard, less for a medium issue like a missing base-uri, and very little for informational notes. Scores of 90 and above earn an A, 75 a B, 55 a C, 35 a D, and anything below that an F. Read the individual findings before acting — a single high-severity gap outweighs several low ones.

Once you've fixed what this checker finds, use the CSP generator to build the header directive by directive, or run the security headers checker to see how CSP fits alongside the rest of your response headers.