CSP Validator
Validate any Content Security Policy header against security best practices. Paste your CSP, click validate, and get an instant security grade (A+ to F) with detailed findings on missing directives, risky keywords, and actionable recommendations - all processed locally in your browser, no data uploaded.
Paste your CSP header value below to validate it against security best practices. The validator checks for missing directives, risky keywords, wildcard sources, and more.
Paste a CSP header above or load an example to get started
All validation happens locally in your browser - no data leaves your device
Why Use Our CSP Validator?
Instant CSP Validation
Paste any Content Security Policy header and get an immediate security analysis. The validator parses every directive, checks source values, and identifies misconfigurations in real-time - no signup or page reload required.
Security Issue Detection
Automatically detects risky patterns including unsafe-inline, unsafe-eval, wildcard sources, missing critical directives, and mixed content risks. Each issue is categorized by severity with clear, actionable explanations.
Policy Score & Grade
Every CSP policy receives a numerical score (0-100) and letter grade (A+ to F) based on its security posture. The grading considers directive completeness, risky keywords, missing protections, and overall policy strictness.
Actionable Recommendations
Get specific, actionable recommendations for improving your CSP. The tool generates an optimized policy suggestion and explains exactly which directives need attention and how to fix each identified issue.
Common Use Cases for CSP Validator
Web Application Security Audit
Audit your Content Security Policy before deploying to production. Validate that your CSP correctly restricts script sources, style origins, and other resource types to prevent XSS and data injection attacks - without breaking legitimate functionality.
Third-Party Script Integration
When adding third-party scripts (analytics, CDN libraries, payment widgets), use the validator to check if the required CSP additions are secure. Validate that the policy accommodates external domains without resorting to unsafe-inline or wildcard sources.
DevOps & Deployment Pipeline
Integrate CSP validation into your CI/CD pipeline. Before deploying a new CSP header to production, validate it through the tool to catch misconfigurations that could either break your site or leave security gaps.
Security Compliance & Standards
Meet security compliance requirements (PCI DSS, HIPAA, SOC 2) by implementing and validating a robust CSP. The validator checks for all recommended directives and highlights gaps that could affect compliance audits.
CMS & Framework Configuration
Validate CSP headers for popular CMS and framework deployments. Whether you are configuring CSP in Next.js, WordPress, Django, or Express.js middleware, the validator helps you craft a policy that works with your tech stack.
CSP Report Analysis & Policy Tuning
After deploying a CSP in report-only mode (Content-Security-Policy-Report-Only), use the validator to check updated policies based on violation reports. Iteratively tune your policy to minimize violations while maintaining strong security.
Understanding Content Security Policy
What is Content Security Policy (CSP)?
Content Security Policy is a W3C standard HTTP header that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks. CSP works by defining a whitelist of trusted sources for different types of content - scripts, stylesheets, images, fonts, frames, and more. When a browser receives a CSP header, it enforces these rules by blocking resources that don't match the policy. CSP provides a powerful defence-in-depth layer that catches attacks even if other security measures fail.
How Our CSP Validator Works
- Parse: The validator parses your CSP header string into individual directives and source values, handling semicolons, spaces, and special keywords correctly.
- Analyze: Each directive is checked against security best practices - missing directives, unsafe keywords, wildcard sources, and insecure schemes are all flagged with appropriate severity levels.
- Report: A comprehensive validation report is generated with a numerical score (0-100), letter grade (A+ to F), categorized warnings, and actionable recommendations for improvement.
What the Validator Checks
- Directive Completeness: Checks for all recommended CSP directives (default-src, script-src, style-src, img-src, connect-src, object-src, frame-ancestors, form-action, base-uri, and more).
- Risky Keywords: Detects dangerous keywords like unsafe-inline, unsafe-eval, unsafe-hashes, and wasm-unsafe-eval in script and style directives.
- Wildcard & Insecure Sources: Flags wildcard sources (*) in sensitive directives and plain HTTP origins that should use HTTPS instead.
- Security Guards: Verifies presence of frame-ancestors (clickjacking protection), upgrade-insecure-requests (mixed content), and reporting directives (violation monitoring).
Privacy & Security
Your CSP policy never leaves your device. All parsing, validation, and analysis happens entirely in your browser using client-side JavaScript. No data is uploaded to any server, and no cookies or tracking are involved. This means you can safely validate even the most sensitive internal policies without any privacy concerns. The tool is completely free and requires no signup or API key.
Related Tools
DNS Propagation Checker
Check if DNS changes have propagated by querying multiple global nameservers (Cloudflare, Google, Quad9). Shows propagation status across regions with live results and colour-coded status indicators - free online DNS propagation checker.
Domain Age Checker
Check the age of any domain in years, months, weeks, and days. Enter a domain name to get its creation date, registration timeline, registrar info, and SEO authority estimate based on domain age - all fetched from the official RDAP registry in real time. Free online domain age checker.
Bulk WHOIS Lookup
Check domain registration information for up to 20 domains at once using the RDAP protocol. View registrar, creation date, expiry date, nameservers, and domain status codes in a sortable table - free online bulk WHOIS lookup.
Domain Expiry Checker
Check when any domain expires - enter a domain name to see its expiration date, days remaining, registrar lock status, auto-renew status, and complete WHOIS details. Colour-coded health indicators show whether renewal is urgent. Free online domain expiry checker.
Frequently Asked Questions About CSP Validator
A Content Security Policy is a security standard that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks. It is implemented as an HTTP header that tells the browser which sources of content are trusted. When properly configured, CSP acts as a powerful defence-in-depth layer that can block malicious scripts even if other security controls fail.
CSP headers can be added at the web server level (Apache, Nginx), through your hosting platform (Cloudflare, Vercel, Netlify), or within your application code (Next.js middleware, Express.js helmet, Django middleware). The header name is either "Content-Security-Policy" (enforcement mode) or "Content-Security-Policy-Report-Only" (monitoring mode). Start with report-only mode to test your policy without blocking legitimate content.
Content-Security-Policy-Report-Only (report-only) tells the browser to monitor and report violations without actually blocking any resources. This is ideal for testing a new policy before enforcement. Content-Security-Policy (enforce) actively blocks resources that violate the policy. Always test in report-only mode first to ensure your policy does not break legitimate functionality on your site.
The unsafe-inline keyword allows inline JavaScript (<script> tags with code, onclick attributes, javascript: URLs) and inline CSS (<style> blocks, style attributes). While convenient for development, this completely bypasses one of CSP's main protections against XSS attacks. If an attacker can inject any HTML, they can execute arbitrary scripts. Use nonces (cryptographic tokens) or hashes to safely allow specific inline scripts instead.
A strong CSP starts with "default-src 'none'" to block everything by default, then explicitly allows only what is needed. It includes "script-src 'self'" (or better, 'strict-dynamic'), "style-src 'self'", restrictive object-src and frame-src (ideally 'none'), "frame-ancestors 'none'" to prevent clickjacking, "form-action 'self'" to restrict form submissions, "base-uri 'self'" to prevent BASE tag injection, and "upgrade-insecure-requests" to enforce HTTPS.
CSP is a powerful defence against XSS, but it is not a silver bullet. It significantly reduces the attack surface by restricting what scripts can execute, but it does not address server-side vulnerabilities or database injection. CSP works best as part of a defence-in-depth strategy alongside proper input validation, output encoding, and secure coding practices. A well-configured CSP can block the vast majority of reflected and stored XSS attacks.
Strict-dynamic is a CSP keyword that tells the browser to trust scripts loaded by other trusted scripts. When you use 'strict-dynamic', you no longer need to list individual CDN domains or third-party script hosts - if a trusted script loads another script, that child script is automatically trusted. This simplifies policy management significantly. However, 'strict-dynamic' requires a nonce or hash on the root script and is not supported in all older browsers.
To set up CSP violation reporting, add the "report-uri" (deprecated but widely supported) or "report-to" (modern replacement) directive to your CSP header. For example: "report-uri https://your-endpoint.com/csp-reports;". The browser will send JSON violation reports to this endpoint whenever a resource is blocked. You can use free services like report-uri.com or set up your own reporting endpoint. In report-only mode, violations are reported without blocking content.
Yes, the CSP Validator is completely free to use. All validation and analysis happens entirely in your browser - no data is uploaded to any server, no API keys are required, and no signup is needed. You can validate as many CSP policies as you want, including sensitive internal policies, with complete privacy.