CSP Analyzer
Parse a CSP header and flag common weaknesses, including missing frame-ancestors and object-src.
Processed locally in your browser. Nothing you enter is uploaded or stored.
- Breaks a dense one-line policy into a readable per-directive view.
- Highlights the patterns that undermine a CSP: `unsafe-inline`, `unsafe-eval`, `*`.
- Flags a missing `frame-ancestors` directive (no clickjacking protection) and a missing `object-src` with no `default-src` fallback (unrestricted plugin content) — gaps in the policy as a whole, not just within a directive that's present.
- Runs in your browser — paste a policy from any environment.
Why this is private
- Processed locally in your browser. Nothing you enter is uploaded or stored.
- Open your browser's DevTools → Network tab while using this tool — you won't see a request carrying your input, because it never leaves your device.
- Nothing you enter is uploaded to a server or shared with us — the processing happens entirely on your device.
Overview
Parses an existing Content-Security-Policy value directive by directive and flags common weaknesses — both within individual directives ('unsafe-inline', 'unsafe-eval', an overly permissive wildcard source) and directives missing from the policy entirely (frame-ancestors, object-src).
How to use it
- 1Paste a CSP header value.
- 2Review each directive and any flagged weaknesses, plus any policy-level warnings for directives missing entirely.
Tips
- This flags common red flags, not a full security audit — some flagged patterns (like 'unsafe-inline' for style-src) are legitimate tradeoffs depending on your app.
Frequently asked questions
What people use it for
Audit a policy you inheritedUnderstand what an existing CSP actually allows before changing it.
Review a policy before enforcing itCatch a wildcard or `unsafe-inline` that would defeat the point.
Check for clickjacking protectionConfirm the policy actually includes frame-ancestors — a policy that's otherwise tight but omits it still leaves the page embeddable in a malicious iframe.
Compare two environmentsPaste staging and production policies to spot the drift.
Learn CSP by exampleSee how each directive in a real policy is interpreted.
Related tools
All security toolsCSP GeneratorBuild a Content-Security-Policy header, including frame-ancestors and a report-only rollout mode.Security Headers CheckerCheck a live site's security-related HTTP headers, with a letter grade.Password Strength CheckerCheck a password's strength and estimated crack time.HMAC GeneratorGenerate an HMAC signature for a message with a secret key.
Ready to use CSP Analyzer?
CSP Analyzer