SSL & Security

CSP Checker

XSS Protection

Check a domain's Content-Security-Policy

We'll request the domain and inspect its Content-Security-Policy header, flagging unsafe or overly permissive directives.

Try:
github.com
mozilla.org
cloudflare.com

Tool features

Comprehensive CSP and security header analysis with recommendations
4 checks

CSP Detection

Check if Content Security Policy is properly configured

Header Analysis

Comprehensive security header analysis and validation

Configuration Validation

Validate CSP parameters and detect configuration issues

Best Practices

Get recommendations for improving your CSP

What is a Content Security Policy & how it works

How a site controls what the browser may load

A Content Security Policy (CSP) is a response header that tells the browser which sources of scripts, styles, images and other content it may load. By allow-listing trusted origins and blocking everything else, CSP is the strongest defence against cross-site scripting (XSS) and content injection.

The policy is published as a Content-Security-Policy header made of directives such as script-src and default-src, each naming permitted sources. This tool reads the live header, breaks it down directive by directive, flags unsafe values like 'unsafe-inline' or *, and scores the overall configuration alongside related security headers.

default-src
The fallback source list for content types without their own directive.
'unsafe-inline'
Allows inline scripts/styles — a common weakness that defeats much of CSP.
report-only
Reports violations without blocking, so you can test a policy safely first.

How to use this tool

Check a domain's CSP in four steps
1
Enter a domain
Type a domain or URL, e.g. example.com — the page is requested over HTTPS.
2
Run the check
Click Check CSP Security to fetch the response and read its Content-Security-Policy header.
3
Review the breakdown
See the security score, the directive-by-directive breakdown, and which security headers are present.
4
Apply the guidance
Tighten flagged directives and add missing headers using the recommendations and linked guides.

Related tools

Keep debugging with tools from the same suite
4 tools
Secure Header Checker
Check security headers like CSP, HSTS, X-Frame-Options, and more with security scoring
HSTS Checker
Check HTTP Strict Transport Security (HSTS) header configuration and preload status
X-Frame Options Checker
Check X-Frame-Options header to prevent clickjacking attacks and iframe embedding
HTTP Header Checker
Analyze HTTP response headers for any website or URL with detailed header information

Frequently asked questions

Common questions about Content Security Policy
5 Q&A

A Content Security Policy (CSP) is an HTTP response header that restricts which sources of scripts, styles, images and other resources a browser may load, mitigating cross-site scripting (XSS) and injection attacks.

'unsafe-inline' allows inline