CSP Analyzer & Builder

CSP Analyzer runs Google's open-source CSP Evaluator checks for unsafe-inline, unsafe-eval, wildcards, bare schemes, known allowlist bypass hosts, missing object-src and script-src, nonce quality and strict-CSP suggestions. A second layer adds checks the evaluator does not cover: duplicate directives, missing base-uri and frame-ancestors, blob: in script sources, wildcard connect-src, reporting setup, Report-Only policies and meta tag limits.

Paste a raw policy, Content-Security-Policy or Content-Security-Policy-Report-Only header lines (also inside a full response header dump), an Nginx add_header directive, an Apache Header set line or an HTML meta tag. When several policies are found, each is analyzed separately, because browsers enforce all of them together.

The grade starts at 100 and subtracts points per finding: High 30, syntax error 20, Medium 15, possible High 15, possible Medium 8 and strict CSP suggestion 5. Each finding type counts once per directive, and possible High plus possible Medium together subtract at most 24. A starts at 90, B at 75, C at 60 and D at 40. It is a heuristic summary of these checks, not a statement that a page is safe.

Build mode starts from a preset (Strict starting point, Static site, SPA + API, Report-Only rollout or Locked-down baseline), lets you edit each directive, adds an optional nonce placeholder and strict-dynamic, and outputs a header line, an Nginx add_header directive or a meta tag. The generated policy is analyzed live. Roll out new policies in Report-Only mode first.

Policies are parsed and analyzed in your browser. Pasted text is not stored, added to the URL or sent to a server; only the selected mode and output format are remembered on this device.