Security Tools
CSP Header Analyzer
Paste an existing Content-Security-Policy header to see it broken down by directive, with common risky patterns flagged.
default-src
'self'
script-src
'self' 'unsafe-inline' https://example.com
⚠ 'unsafe-inline': Allows inline scripts/styles, defeating much of CSP's XSS protection.
object-src
'none'
⚠ No base-uri directive — without it, an injected <base> tag could redirect relative URLs.
Flags a few commonly cited risky patterns, but isn't a full CSP audit — see the CSP header generator for building a new policy from scratch.
How to use this tool
- 1Paste your CSP header.
- 2See each directive broken down.
- 3Review flagged risky patterns.
Frequently asked questions
Is this a complete CSP security audit?+
No — it flags a few commonly cited risky patterns (like unsafe-inline) as a starting point, not a substitute for a full security review.