CSP Evaluator
Find security weaknesses in your Content-Security-Policy
Paste your CSP header
About the Csp Evaluator
A Content-Security-Policy is only as good as its weakest directive. unsafe-inline in script-src defeats the entire purpose. A wildcard (*) allows scripts from anywhere. Missing frame-ancestors leaves the page open to clickjacking. These are the misconfigurations that make a CSP look good while providing almost no real protection.
Paste your CSP header and this evaluator checks it against known bypass patterns, missing hardening directives, and common mistakes. Each finding includes severity and a specific explanation of why it matters and how to fix it. All analysis is local — your CSP never leaves the browser.
How to use
- Copy your Content-Security-Policy header from DevTools or your server config.
- Paste it into the evaluator.
- Review each finding by severity (high, medium, low).
- Fix the issues using the recommendations, or use our CSP Generator.
Frequently Asked Questions
What is the most common CSP mistake? ▾
Including 'unsafe-inline' in script-src. This allows inline <script> tags and event handlers, which defeats CSP's core purpose of preventing XSS. Use nonces (per-request tokens) or hashes instead.
Is a wildcard (*) ever safe? ▾
In img-src it is common and low-risk. In script-src, connect-src, or frame-src it is dangerous — it allows loading code or making requests to attacker-controlled domains.
Is this tool free to use? ▾
Yes! This tool is 100% free. No signup, no credit card, no limits. It's part of Formatho's privacy-first developer toolkit.
Is my data safe? Does this tool send data to a server? ▾
Absolutely. This tool runs entirely in your browser. Your data never leaves your device. Zero server-side processing, zero tracking.