Basic CSP Evaluator

You copied a Content-Security-Policy from a tutorial, pasted it into your server config, and now you want to know whether it actually protects anything. Paste the header value here and the check flags the four things that go wrong most often in copied policies: unsafe-inline, unsafe-eval, a missing default-src and a missing object-src. Output updates as you type, no button involved.

Two rules explain most of the warnings. Without default-src there is no fallback, so every directive you did not declare stays wide open, including img-src, connect-src and frame-src. And unsafe-inline inside script-src hands back the exact vector the policy was written to close. One quirk worth knowing: the check is textual, so a policy that already uses a nonce still gets flagged for unsafe-inline, even though browsers ignore that keyword when a nonce is present.

Treat the output as a four-item checklist rather than an audit. It does not walk directive by directive and it does not judge source lists, so a script-src with a wildcard, or one pointing at a CDN that serves arbitrary user uploads, will slip through and needs your own eyes. The safer rollout is to ship the policy as Content-Security-Policy-Report-Only first, read the reports for a few weeks, then enforce. Nothing you paste leaves your browser.