🔏

CSP Analyzer

Paste a CSP header or enter a URL to auto-fetch. Get a detailed breakdown of unsafe-inline, wildcards, and missing directives.

Why CSP matters

Content Security Policy is the browser's primary defense against XSS attacks. A missing or weak CSP is the single most common OWASP A05 finding. Even a present CSP with unsafe-inline is nearly as bad as no CSP at all.

What we flag

'unsafe-inline' - Allows inline scripts and styles. Defeats most XSS protection.
'unsafe-eval' - Allows eval() and similar. Enables code injection.
Wildcard sources (*) - Allows content from any domain. Significantly weakens policy.
Missing default-src / script-src - No baseline restriction on script sources.
Missing frame-ancestors - No clickjacking protection from CSP.
Missing report-uri/report-to - Violations are silent; no visibility into attacks.