Find typos, missing semicolons and invalid sources in a Content-Security-Policy
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 16 Oct 2026.A browser does not reject a broken Content-Security-Policy; it quietly ignores the parts it cannot read. A misspelt frame-ancestor, a missing semicolon that turns script-src into a source of default-src, or self written without its quotes all leave the page less protected than it looks. Paste the header and every directive and source is checked against the CSP Level 3 grammar, with the line that is wrong.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
A Content-Security-Policy is easy to get subtly wrong, and browsers never complain: a directive they cannot read is ignored. This tool reads the policy exactly as the CSP Level 3 specification says a browser does, then judges it against the findings of Google's 2016 study of real policies.
| Severity | Examples |
|---|---|
| High | 'unsafe-inline' without a nonce, * or https: in script-src, object-src not 'none', 'strict-dynamic' with no nonce, a missing semicolon, self without quotes |
| Medium | 'unsafe-eval', allowlisted hosts known to serve JSONP or old AngularJS, base-uri open, plain http sources, unknown directives |
| Low | no frame-ancestors, short nonces, obsolete directives, duplicates, 'unsafe-inline' for styles |
| Note | no reporting, report-uri without report-to, sources a strict policy makes browsers ignore |
Paste anything. The bare policy, the whole header line, or a <meta http-equiv> tag. Policies delivered in a meta tag cannot use frame-ancestors, report-uri or sandbox, and the tool flags those. A header with several comma-separated policies is split, since each is enforced.
The rest of the article, and all 6 questions about CSP Evaluator, are on the CSP Evaluator page.
No. With 'unsafe-inline', any script an attacker manages to inject into the page runs, which is exactly what a Content-Security-Policy exists to stop. Use a nonce or hash for each inline script instead. Once a nonce or hash is present, modern browsers ignore 'unsafe-inline', so keeping it as a fallback for old browsers is harmless.
The 'strict-dynamic' keyword lets a script that was trusted through a nonce or hash load further scripts, while host allowlists and https: are ignored by browsers that support it. Combined with a nonce, it gives a policy that is both strict and easy to deploy. Without any nonce or hash, it blocks every script.
The browser ignores the directive and logs a console warning, but the rest of the policy still applies, so the page loses that protection silently. A typo such as frame-ancestor instead of frame-ancestors leaves the page open to clickjacking. This tool lists unknown directives and suggests the name you probably meant.
Yes, with a meta http-equiv tag in the page head, but three directives do not work there: frame-ancestors, report-uri and sandbox. Policies in a meta tag also apply only to content after the tag. Sending the policy as an HTTP response header is the reliable choice; the meta tag suits static hosting without header control.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about CSP Evaluator and anybody who knows can answer. No account needed.
Same job, other tools: Check IMEI Number Validity – Test a list of IMEIs for a correct Luhn check digit, one per line, and copy the results.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember.