Evaluate your Content-Security-Policy (CSP) headers against modern W3C CSP Level 3 standards. Detect dangerous keywords like unsafe-inline and unsafe-eval, identify missing object-src restrictions, and verify cryptographic nonce/hash setups.
Enter a live public website URL to retrieve response headers or paste a CSP policy string for instant browser-side analysis.
Validating URL, retrieving HTTP response headers, finding CSP directives, and evaluating source containment…
The CSP Checker analyzes Content-Security-Policy response headers to identify misconfigurations that leave web applications vulnerable to Cross-Site Scripting (XSS), clickjacking, and data injection attacks.
It parses directives such as script-src, object-src, base-uri, and frame-ancestors, checking for dangerous fallback patterns, insecure wildcards (*), and weak whitelist sources that attackers can easily bypass.
Enter a live website URL or paste a raw Content-Security-Policy string for immediate static parsing.
Deconstructs the policy into individual directive tokens and evaluates source expressions.
Scans for dangerous directives: unsafe-inline without nonces, unsafe-eval, missing object-src, and missing base-uri.
Provides actionable guidance to transition from legacy whitelists to a modern Strict CSP model.
| Result / Status | Technical Meaning | Recommended Action |
|---|---|---|
| Strict CSP (Optimal) | Uses cryptographic nonces or hashes with strict-dynamic, object-src 'none', and base-uri 'none'. | Maintain configuration; ensure dynamic nonces rotate uniquely per HTTP response. |
| Permissive Whitelist | Relies on domain whitelists (e.g., cdnjs.cloudflare.com) vulnerable to JSONP and open-redirect script execution. | Transition to a Nonce-based Strict CSP with 'strict-dynamic' to prevent whitelist bypasses. |
| High Risk (unsafe-inline) | Contains 'unsafe-inline' without cryptographic nonces, completely disabling CSP script execution defense. | Remove 'unsafe-inline'; implement server-side request nonces or external hashed script bundles. |
| Missing Policy | No Content-Security-Policy header detected on the target domain. | Deploy a baseline CSP initially using Content-Security-Policy-Report-Only before enforcement. |
Historically, CSP relied on domain whitelists (e.g., script-src https://*.googleapis.com). Security research demonstrated that over 95% of whitelist-based CSPs can be bypassed using open redirects, JSONP endpoints, or hosted AngularJS/React libraries residing on whitelisted origins.
Modern W3C CSP Level 3 standardizes Strict CSP: script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none'. The 'strict-dynamic' keyword instructs modern browsers to trust scripts dynamically loaded by an already-authorized nonced root script, dramatically simplifying adoption while eliminating whitelist bypass vectors.
Configuring strict nonces and hashes for React, Vue, or Next.js build artifacts.
Verifying that staging environments enforce strict CSP directives before production releases.
Pinpointing wildcard sources and unsafe directives during web application security assessments.
Analyzing CSP violation report schemas before flipping policies from Report-Only to Enforce.
Maintaining an accurate threat model requires understanding what external point-in-time tools can and cannot evaluate:
Complementary security utilities, audit calculators, and posture generators.
Audit all foundational HTTP security headers alongside Content-Security-Policy.
Verify session cookie flags to mitigate session theft if XSS occurs.
Perform a comprehensive health check across HTTPS, DNS, and HTTP headers.
Verify canonical HTTPS routing and HSTS preload configurations.
This tool operates in direct accordance with verified cybersecurity standards and technical specifications established by authoritative primary institutions:
Primary international standard governing Content Security Policy syntax, directives, and browser behaviors.
Practical engineering guidance for implementing robust, bypass-resistant CSP deployments.
Connect into related diagnostic engines, calculators, compliance generators, and foundational cybersecurity architectures across SafeNetworkHub:
