Skip to content
ITDWeb Security Platform
ITD
Search

CSP Builder / Checker

Paste one CSP response header, including the header name for Report-Only. This local text check supports up to 16,384 characters and 128 directives. It does not verify site behavior or security.

Everything runs in your browser. Your input is never sent to a server.

Use the tool

Paste a CSP above to see the analysis.

Policy template — test before applying

Preserve the existing policy and test changes in a controlled environment. Do not replace a working CSP with the template. Check actual responses and essential pages, login and integrations; restore the previous configuration if needed.

default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; upgrade-insecure-requests

How to use

  1. 1

    Paste one CSP response header, including the header name for Report-Only. This local text check supports up to 16,384 characters and 128 directives. It does not verify site behavior or security.

  2. 2

    Each directive is parsed and risky values are listed with a severity.

  3. 3

    Preserve the existing policy and test changes in a controlled environment. Do not replace a working CSP with the template. Check actual responses and essential pages, login and integrations; restore the previous configuration if needed.

Why it matters

CSP helps reduce XSS impact, but source lists, directive precedence and nonce/hash implementation matter. default-src does not restrict form-action or frame-ancestors. Report-Only does not block code or connections; verify enforcement separately.

FAQ

QIs my pasted policy sent anywhere?
A

No. All parsing runs in your browser (JavaScript); your input is never sent to a server.

QWhy is unsafe-inline dangerous?
A

Broad inline permission can weaken protection. With nonces, hashes or script strict-dynamic, supporting browsers may ignore unsafe-inline. This text check does not verify nonce randomness, reuse or agreement with the site.

Related