How do I check a website's Content Security Policy?

Enter the URL into a CSP checker to read the site's response headers and validate its Content-Security-Policy.

What is Content Security Policy?

CSP is an HTTP header that tells browsers which sources of content — scripts, styles, images — a page is allowed to load, blocking malicious injected content like cross-site scripting (XSS).

Why do I need a Content Security Policy?

CSP protects visitors from XSS and data-injection attacks, helps meet security compliance requirements, and is increasingly expected on professional websites.

How do I implement a Content Security Policy?

Start with a report-only policy to observe violations, then enforce a strict policy via the Content-Security-Policy header or meta tag, whitelisting only trusted sources.

WEBSITE SECURITY TOOLS · FREE ONLINE TOOL

Content Security Policy Checker

Parse and grade any website Content Security Policy directive by directiveCross-site scripting is still one of the most exploited web vulnerabilities, and a Content Security Policy is the closest thing to a cure. Enter a URL and get your live policy parsed into a readable, directive-by-directive view.

✓ Free to use✓ No sign-up✓ Ready in your browser

// CONTENT SECURITY POLICY CHECKER · GET STARTED

Use Content Security Policy Checker

Parse and grade any website Content Security Policy directive by directive

// CONTENT SECURITY POLICY CHECKER · AT A GLANCE

Content Security Policy Checker: what to know first.

Parse and grade any website Content Security Policy directive by directive

01
Content Security Policy is the single most effective browser-level defense against cross-site scripting, yet most deployed policies are either missing or quietly neutered by directives like unsafe-inline. The CSP Checker fetches the live policy from the response header (falling back to meta tags), parses every directive, and evaluates what each one actually permits, so you see the policy the way an attacker would read it.
02
Every directive gets a plain-language verdict: what is locked down, what is weak, and what is missing entirely. The result is an A to F grade plus concrete fixes, from replacing unsafe-inline with nonces to adding the object-src and base-uri directives most sites forget.

// CONTENT SECURITY POLICY CHECKER · HOW IT WORKS

How to use the Content Security Policy Checker

Enter URL

Enter the website URL you want to test (e.g. https://example.com).

Parse the policy

Click "Check CSP" and wait while the policy is fetched and parsed.

Review the grade

Review the A to F grade and the directive-by-directive findings.

// CONTENT SECURITY POLICY CHECKER · ABOUT THIS TOOL

About the Content Security Policy Checker

Content Security Policy is the single most effective browser-level defense against cross-site scripting. The CSP Checker fetches the live policy, parses every directive, and shows you what it actually permits.

Every directive gets a plain-language verdict, plus an A to F grade and concrete fixes for common weaknesses.

Where it helps most

Turning a scary header into a manageable checklist.

Pre-review audits

Audit your own policy before a security review and see exactly where it stands today.

Debugging blocked scripts

Find exactly which directive is blocking legitimate scripts, instead of guessing blindly.

Vendor sanity checks

Verify a vendor's claims about their security posture with your own eyes.

Report-only rollouts

Use violation reports to build an accurate allowlist before flipping enforcement on.

Reading the report

The weaknesses that quietly gut a policy.

unsafe-inline and unsafe-eval

These permit exactly the attack vector a CSP is meant to close; the fix is moving toward nonces or hashes.

Wildcards and data: URIs

Wildcard sources and data: URIs in script-src open holes that attackers love to abuse.

Missing directives

Missing object-src and base-uri leave gaps in coverage; the report flags what your policy forgot.

Content Security Policy Checker: built for trust

Each finding explains why it matters in plain language, not spec jargon. No signup needed.

// CONTENT SECURITY POLICY CHECKER · COMMON QUESTIONS

Content Security Policy Checker FAQs

What does a Content Security Policy actually do?

It gives the browser an allowlist of trusted sources for scripts, styles, images, fonts, and frames. Anything not on the list is blocked, which stops most cross-site scripting attacks even if an attacker manages to inject code into your page.

Why is unsafe-inline in my policy a problem?

Will adding a CSP break my website?

What is the difference between CSP and HSTS?

How strict should my CSP be?

tools-guide

WHOIS Lookup: Find Out Who Owns Any Domain Instantly

Free WHOIS lookup for any domain. Check the registrar, registration and expiry dates, name servers and the full WHOIS record instantly, no sign-up needed.

Read article →