What is a CSP Analyzer?
A CSP can look impressive while protecting nothing: script-src with unsafe-inline quietly re-opens the XSS door the policy was meant to close.
Paste any policy for a directive-by-directive breakdown with the classic weaknesses flagged: unsafe-inline, unsafe-eval, wildcards, missing default-src, http: sources.
Frequently asked questions
Why is unsafe-inline so bad?
It allows inline <script> blocks: exactly what injected XSS payloads are. Nonces or hashes let your own inline scripts run without opening that door.
What does default-src do?
It is the fallback for every fetch type you didn’t list. Without it, anything unlisted is unrestricted.
How do I deploy CSP safely?
Start with Content-Security-Policy-Report-Only, watch violation reports, tighten, then enforce.
Does this tool fetch my site?
No: you paste the policy; analysis is local. Use the Security Headers Checker to fetch it.