SSL & Security
CSP Checker
Check a domain's Content-Security-Policy
Tool features
4 checks
CSP Detection
Check if Content Security Policy is properly configured
Header Analysis
Comprehensive security header analysis and validation
Configuration Validation
Validate CSP parameters and detect configuration issues
Best Practices
Get recommendations for improving your CSP
What is a Content Security Policy & how it works
A Content Security Policy (CSP) is a response header that tells the browser which sources of scripts, styles, images and other content it may load. By allow-listing trusted origins and blocking everything else, CSP is the strongest defence against cross-site scripting (XSS) and content injection.
The policy is published as a Content-Security-Policy header made of directives such as script-src and default-src, each naming permitted sources. This tool reads the live header, breaks it down directive by directive, flags unsafe values like 'unsafe-inline' or *, and scores the overall configuration alongside related security headers.
default-src
The fallback source list for content types without their own directive.
'unsafe-inline'
Allows inline scripts/styles — a common weakness that defeats much of CSP.
report-only
Reports violations without blocking, so you can test a policy safely first.
How to use this tool
1
Enter a domain
Type a domain or URL, e.g.
example.com — the page is requested over HTTPS.2
Run the check
Click Check CSP Security to fetch the response and read its Content-Security-Policy header.
3
Review the breakdown
See the security score, the directive-by-directive breakdown, and which security headers are present.
4
Apply the guidance
Tighten flagged directives and add missing headers using the recommendations and linked guides.
Related tools
5 tools
Secure Header Checker
Check security headers like CSP, HSTS, X-Frame-Options, and more with security scoring
HSTS Checker
Check HTTP Strict Transport Security (HSTS) header configuration and preload status
Cookie Security Checker
Audit every Set-Cookie header a site returns for the Secure, HttpOnly, SameSite, prefix, scope and expiry attributes
X-Frame Options Checker
Check X-Frame-Options header to prevent clickjacking attacks and iframe embedding
HTTP Header Checker
Analyze HTTP response headers for any website or URL with detailed header information
Frequently asked questions
5 Q&A
'unsafe-inline' allows inline <script> and style attributes to run, which defeats much of the XSS protection CSP provides. Prefer nonces or hashes so only your own inline code is allowed.
Content-Security-Policy enforces the policy and blocks violations, while Content-Security-Policy-Report-Only only reports them without blocking. Report-only lets you trial a policy on production traffic before enforcing it.
Start with default-src 'self', add explicit script-src and style-src for the origins you actually use, avoid 'unsafe-inline' and wildcards, and roll it out in report-only mode first to catch anything you missed.
No. CSP works alongside headers like HSTS, X-Content-Type-Options and Referrer-Policy. This tool checks those too, since a strong security posture needs the full set, not CSP alone.