What is a CSP Analyzer?
A CSP can look impressive while protecting nothing — script-src with unsafe-inline quietly re-opens the XSS door the policy was meant to close.
Paste any policy for a directive-by-directive breakdown with the classic weaknesses flagged: unsafe-inline, unsafe-eval, wildcards, missing default-src, http: sources.
How to use the CSP Analyzer
- Copy the CSP value from your response headers (the HTTP Header Checker shows it).
- Paste and analyze.
- Fix the flagged weaknesses, most impactful first.
Frequently asked questions
Why is unsafe-inline so bad?
It allows inline <script> blocks — exactly what injected XSS payloads are. Nonces or hashes let your own inline scripts run without opening that door.
What does default-src do?
It is the fallback for every fetch type you didn’t list. Without it, anything unlisted is unrestricted.
How do I deploy CSP safely?
Start with Content-Security-Policy-Report-Only, watch violation reports, tighten, then enforce.
Does this tool fetch my site?
No — you paste the policy; analysis is local. Use the Security Headers Checker to fetch it.