CSP Header Builder & Analyzer
Write or paste a Content-Security-Policy header and see it parsed, with common risks flagged (wildcards, unsafe-inline/unsafe-eval, missing fallbacks). Runs entirely in your browser.
[ CSP ]
Flags common risks — not an exhaustive CSP audit.
[ ANALYSIS ]
DIRECTIVES
// waiting for a policy
About CSP Header Builder & Analyzer
A Content-Security-Policy header controls which sources a page may load scripts, styles, images, and frames from. This parses a policy into its directives and points out settings that weaken it.
How to use it
- Paste an existing Content-Security-Policy value, or start building one.
- Read the per-directive breakdown.
- Review the flagged risks, such as unsafe-inline on script-src or a wildcard host.
- Copy the policy back into your server or framework config.
Frequently asked questions
- What does it flag?
- Common weakening patterns: unsafe-inline and unsafe-eval, wildcard sources, and a missing default-src to act as a fallback. It is a lint, not a guarantee.
- Does a clean report mean my site is secure?
- No. It checks the policy's shape, not whether it fits your app. A strict policy that breaks your site helps nobody; test it in report-only mode first.
- Is my header sent anywhere?
- No. Parsing happens in your browser.