Content security policy checker

What the CSP checker does

This tool requests a website and checks whether the response includes a Content-Security-Policy header. It reports the policy value when present, giving you a view of how the site restricts resource loading.

Content Security Policy is a browser security mechanism that helps prevent cross-site scripting and other injection attacks. The policy declares which sources of scripts, styles, images, frames, and other resources the browser is allowed to load. A well-configured policy reduces the impact of an injection flaw by blocking unauthorized scripts.

Why CSP matters

Cross-site scripting remains one of the most common web vulnerabilities. CSP adds a layer of defense by limiting what the browser will execute, even if malicious code finds its way into a page. It also helps detect and report policy violations.

Deploying CSP requires care. A policy that is too permissive provides little protection, while one that is too strict can break legitimate features. Many teams start with a report-only mode to observe violations before enforcing, then tighten the policy incrementally.

How to interpret the result

If a policy is present, review its directives. Common directives include default-src, script-src, style-src, and img-src. Look for broad allowances such as 'unsafe-inline' or wildcard sources, which weaken the policy. A policy that allows inline scripts without nonces or hashes leaves a major injection vector open.

If no policy is reported, the site does not send a CSP header. That does not mean the site is insecure, but it does mean this defense layer is absent. For sites handling sensitive data or user content, adding a policy is a meaningful hardening step.

Common CSP issues

• Missing header. No policy is sent.
• Overly broad sources. Wildcards that allow any host.
• Unsafe inline allowances. 'unsafe-inline' or 'unsafe-eval' weakening protection.
• Report-only mode left indefinitely. Violations are logged but not blocked.
• Policies that break features. Overly strict rules causing scripts or styles to fail.

Practical workflow

Check the header on key pages, including authenticated areas. If a policy is present, review the directives and tighten broad allowances where possible. If none is present, start with report-only mode, collect violation reports, and then enforce a policy that fits your actual resource needs. Re-check after adding third-party scripts, since they often require policy updates.

Limitations

The checker reports the CSP header on the response it receives. It does not evaluate whether the policy is effective against specific attacks, and CDNs or proxies may add or alter headers.