Content Security Policy guide
Understand and strengthen your CSP
A Content-Security-Policy limits which scripts, styles, images, frames, and connections a browser may load. This CSP analyzer helps developers find permissive directives before they become an easy path to cross-site scripting or data exfiltration.
What the analyzer checks
The audit evaluates each directive in context, including fallback behavior from default-src and the risks created by broad sources. It highlights missing controls and explains why a recommendation matters instead of returning only a pass/fail score.
- unsafe-inline and unsafe-eval
- Wildcard sources and data: URLs
- object-src and base-uri
- frame-ancestors and clickjacking protection
How to use the result
Start with reporting-only mode when rolling out a new policy, remove broad sources one at a time, and replace inline behavior with nonces or hashes where possible. Test the policy across authenticated and unauthenticated application flows before enforcing it.
Privacy and safe testing
The policy text is analyzed in your browser and the tool does not require an account. Do not paste secrets or proprietary configuration into any third-party tool; use the result as engineering guidance and verify changes in your own browser test suite.