By Updated

CSP Evaluator

Audit a Content-Security-Policy for unsafe directives, wildcards, missing object-src/base-uri, weak nonces, and other XSS escape hatches. Paste a policy or fetch a URL: get severity-grouped findings with remediation.

Interactive tool

Input

Findings

Paste a CSP or fetch a URL to see severity-grouped findings.

What is the CSP Evaluator?

A Content-Security-Policy auditor that mirrors Google CSP Evaluator-style heuristics. Paste a policy or fetch any URL: the tool flags unsafe directives (wildcards in script-src, missing object-src, weak nonces, plain HTTP hosts), grades the policy A through F, and lists copy-paste remediation snippets.

How to Use the CSP Evaluator

  1. 1Pick an input mode: paste a CSP directly, or fetch any URL through our SSRF-safe backend
  2. 2Review the grade and the per-severity findings (HIGH / MEDIUM / LOW / INFO)
  3. 3For each finding, copy the remediation snippet into your CSP Generator
  4. 4Re-run the evaluator with the updated policy to confirm the finding cleared
What you get

Key features

Grade A-F

Simple letter grade based on finding counts: 0 HIGH/MEDIUM → A, 1+ MEDIUM → B, 3+ MEDIUM or 1+ HIGH → C/D, 3+ HIGH → F.

Severity-grouped findings

HIGH (wildcards, unsafe-eval, missing object-src/base-uri), MEDIUM (style-src unsafe-inline, short nonces, plain HTTP), LOW (deprecated directives, missing reporting).

Per-finding remediation

Each finding includes a one-sentence "what to change" hint: paste it into the CSP Generator or your security playbook.

Two input modes

Paste the policy text directly, or fetch any URL to extract its CSP and CSP-Report-Only headers automatically.

Recognises header prefixes

Pastes that include "Content-Security-Policy: ..." or "Content-Security-Policy-Report-Only: ..." are stripped automatically.

Surfaces unknown directives

Unrecognised directive names are listed separately so a typo never silently weakens your policy.

Why audit a CSP?

A CSP is only as strong as its weakest directive. A wildcard in script-src, a missing object-src, or an inline-script escape hatch nullifies the rest of the policy. Running an automated audit catches these regressions early, especially after a deploy that quietly added a third-party tag.

Common use cases

  • Pre-deploy security review of a new CSP
  • Verifying a third-party tool did not weaken your existing CSP
  • Comparing your policy against competitors / industry baselines
  • Triaging a Bug Bounty report that claims your CSP is bypassable
  • Periodically re-checking production policies for drift

Heuristics, not certainty

The evaluator analyses the policy text alone. It cannot tell you whether an allowlisted origin (e.g. a popular CDN) hosts a known-bypass-able script: that requires a runtime check. Use this as a fast pre-check, not the only line of defence.

Score thresholds

  • A: zero HIGH and zero MEDIUM findings.
  • B: 1-2 MEDIUM findings, no HIGH.
  • C: 3+ MEDIUM findings, no HIGH.
  • D: 1-2 HIGH findings.
  • F: 3+ HIGH findings.
Pro tips

Tips & best practices

Audit Report-Only headers too

A Report-Only policy still ships in production: a wildcard there means real-world violations go uncaught.

Cross-check with the live header

Use Fetch URL mode to confirm the deployed policy matches what your codebase claims. Frameworks and reverse proxies sometimes rewrite headers.

Pair with the CSP Generator

Findings copy directly into the CSP Generator’s preset slots. Build → evaluate → build is the supported loop.

Built for trust

Privacy & security

Paste mode runs entirely in your browser. Fetch mode routes through our SSRF-safe backend. Rate limiting is enforced, and URLs are not logged.

Frequently Asked Questions

What does the CSP Evaluator check for?

Wildcards in script-src, 'unsafe-inline' without nonces/hashes, 'unsafe-eval', missing object-src and base-uri, short nonces, plain HTTP origins, missing frame-ancestors / form-action, missing reporting endpoints, and deprecated directives.

How is the letter grade decided?

0 HIGH and 0 MEDIUM findings → A. 1-2 MEDIUM → B. 3+ MEDIUM → C. 1-2 HIGH → D. 3+ HIGH → F.

Does the evaluator follow allowlisted origins?

No. It analyses the policy text alone. It cannot tell you whether a known-bypass-able script lives on an allowlisted CDN: that requires a runtime check.

Can it evaluate Report-Only headers?

Yes: paste either the enforcing or the Report-Only header. The "Content-Security-Policy(-Report-Only): " prefix is stripped automatically.

Is fetching a URL safe?

Yes. Fetch mode routes through our SSRF-safe backend, which blocks non-public addresses and enforces per-IP rate limiting.