CSP Evaluator
Audit a Content-Security-Policy for unsafe directives, wildcards, missing object-src/base-uri, weak nonces, and other XSS escape hatches. Paste a policy or fetch a URL: get severity-grouped findings with remediation.
Interactive tool
Input
Findings
Paste a CSP or fetch a URL to see severity-grouped findings.
What is the CSP Evaluator?
A Content-Security-Policy auditor that mirrors Google CSP Evaluator-style heuristics. Paste a policy or fetch any URL: the tool flags unsafe directives (wildcards in script-src, missing object-src, weak nonces, plain HTTP hosts), grades the policy A through F, and lists copy-paste remediation snippets.
How to Use the CSP Evaluator
- 1Pick an input mode: paste a CSP directly, or fetch any URL through our SSRF-safe backend
- 2Review the grade and the per-severity findings (HIGH / MEDIUM / LOW / INFO)
- 3For each finding, copy the remediation snippet into your CSP Generator
- 4Re-run the evaluator with the updated policy to confirm the finding cleared
Key features
Grade A-F
Simple letter grade based on finding counts: 0 HIGH/MEDIUM → A, 1+ MEDIUM → B, 3+ MEDIUM or 1+ HIGH → C/D, 3+ HIGH → F.
Severity-grouped findings
HIGH (wildcards, unsafe-eval, missing object-src/base-uri), MEDIUM (style-src unsafe-inline, short nonces, plain HTTP), LOW (deprecated directives, missing reporting).
Per-finding remediation
Each finding includes a one-sentence "what to change" hint: paste it into the CSP Generator or your security playbook.
Two input modes
Paste the policy text directly, or fetch any URL to extract its CSP and CSP-Report-Only headers automatically.
Recognises header prefixes
Pastes that include "Content-Security-Policy: ..." or "Content-Security-Policy-Report-Only: ..." are stripped automatically.
Surfaces unknown directives
Unrecognised directive names are listed separately so a typo never silently weakens your policy.
Why audit a CSP?
A CSP is only as strong as its weakest directive. A wildcard in script-src, a missing object-src, or an inline-script escape hatch nullifies the rest of the policy. Running an automated audit catches these regressions early, especially after a deploy that quietly added a third-party tag.
Common use cases
- Pre-deploy security review of a new CSP
- Verifying a third-party tool did not weaken your existing CSP
- Comparing your policy against competitors / industry baselines
- Triaging a Bug Bounty report that claims your CSP is bypassable
- Periodically re-checking production policies for drift
Heuristics, not certainty
The evaluator analyses the policy text alone. It cannot tell you whether an allowlisted origin (e.g. a popular CDN) hosts a known-bypass-able script: that requires a runtime check. Use this as a fast pre-check, not the only line of defence.
Score thresholds
- A: zero HIGH and zero MEDIUM findings.
- B: 1-2 MEDIUM findings, no HIGH.
- C: 3+ MEDIUM findings, no HIGH.
- D: 1-2 HIGH findings.
- F: 3+ HIGH findings.
Tips & best practices
Audit Report-Only headers too
A Report-Only policy still ships in production: a wildcard there means real-world violations go uncaught.
Cross-check with the live header
Use Fetch URL mode to confirm the deployed policy matches what your codebase claims. Frameworks and reverse proxies sometimes rewrite headers.
Pair with the CSP Generator
Findings copy directly into the CSP Generator’s preset slots. Build → evaluate → build is the supported loop.
Privacy & security
Paste mode runs entirely in your browser. Fetch mode routes through our SSRF-safe backend. Rate limiting is enforced, and URLs are not logged.
Related tools
- Schema Markup Generator
Generate valid JSON-LD schema markup for Article, Product, Organization, LocalBusiness, BreadcrumbList, FAQPage, Event, Recipe, VideoObject, WebSite, and WebPage: Rich Results-ready.
SEO Tools
- HTML Link Extractor
Extract every link from any HTML page: anchors, images, iframes, scripts, stylesheets, and meta canonical/og:url. Paste HTML or fetch a URL, get a categorised table with internal vs external counts and CSV export.
SEO Tools
- Open Graph Preview
Preview how a URL appears on Facebook, LinkedIn, Twitter, Slack, and Discord, with a checklist for missing OG and Twitter card tags
SEO Tools
- Redirect Rules Generator
Generate Apache .htaccess and Nginx redirect snippets from a single rule list. Supports exact, prefix, and regex matches with 301/302/307/308 status codes, query-string passthrough, case-insensitive matching, and CSV import.
SEO Tools
- Slug Generator
Convert any text to clean, SEO-friendly URL slugs with diacritics stripping, custom separators, and bulk mode
SEO Tools
- Canonical URL Generator
Build the canonical URL for any page and get a drop-in <link rel="canonical"> snippet. Lowercases the host, strips default ports, removes UTM/tracking params, forces HTTPS, and de-duplicates query parameters.
SEO Tools
Frequently Asked Questions
What does the CSP Evaluator check for?
Wildcards in script-src, 'unsafe-inline' without nonces/hashes, 'unsafe-eval', missing object-src and base-uri, short nonces, plain HTTP origins, missing frame-ancestors / form-action, missing reporting endpoints, and deprecated directives.
How is the letter grade decided?
0 HIGH and 0 MEDIUM findings → A. 1-2 MEDIUM → B. 3+ MEDIUM → C. 1-2 HIGH → D. 3+ HIGH → F.
Does the evaluator follow allowlisted origins?
No. It analyses the policy text alone. It cannot tell you whether a known-bypass-able script lives on an allowlisted CDN: that requires a runtime check.
Can it evaluate Report-Only headers?
Yes: paste either the enforcing or the Report-Only header. The "Content-Security-Policy(-Report-Only): " prefix is stripped automatically.
Is fetching a URL safe?
Yes. Fetch mode routes through our SSRF-safe backend, which blocks non-public addresses and enforces per-IP rate limiting.